Posts

Liberica JDK 8u512, 11.0.33, 17.0.21, 21.0.13, 25.0.5, and 27.0.1 builds are generally available

Updated Oct 21, 2026

Aleksei Voitylov

We are happy to announce the general availability of a Critical Patch Update (CPU) of Liberica JDK versions 6u521, 7u521, 8u511, 11.0.32.1.1, 17.0.20.1.1, 21.0.12.1.1, 25.0.4.1.1. CPU releases are stabilized builds that include patches for Common Vulnerabilities and Exposures (CVE) described in the relevant CVE entries in BellSoft’s Security Advisory.

BellSoft is one of only three companies including Oracle that release CPU builds aimed at eliminating known security issues without disrupting the production environment.

In addition, we release PSU versions 8u512, 11.0.33, 17.0.21, 21.0.13, 25.0.5, and 27.0.1 with non-critical fixes and general improvements.

The release contains 1438 fixes and backports overall. BellSoft participated in eliminating 144 issues in all releases.

How to keep your runtime secure

BellSoft recommends updating Liberica JDK with each Critical Patch Update (CPU) to ensure the stable work and secure performance of the runtime. CPUs are scheduled for release in January, April, June, and October every year. Liberica JDK updates and patches are available at no cost.

Download Liberica JDK

The summary of fixes

52 security issues (CVEs) fixed.
278 total security fixes (+ 178 additional non-security fixes) in CPU release:

in Liberica 6u521: 36 security fixes + 27 additional fixes;
in Liberica 7u521: 38 security fixes + 37 additional fixes;
in Liberica 8u511: 38 security fixes + 32 additional fixes;
in Liberica 11.0.32.1.1: 40 security fixes + 25 additional fixes;
in Liberica 17.0.20.1.1: 39 security fixes + 21 additional fixes;
in Liberica 21.0.12.1.1: 43 security fixes + 19 additional fixes;
in Liberica 25.0.4.1.1: 44 security fixes + 17 additional fixes.

In addition, PSU releases include a total of 982 fixes and backports:

in Liberica 8u512: 38 security fixes (+ 10 in FX) + 54 additional fixes (+ 15 in FX);
in Liberica 11.0.33: 40 security fixes (+ 10 in FX) + 53 additional fixes (+ 16 in FX);
in Liberica 17.0.21: 39 security fixes (+ 10 in FX) + 158 additional fixes (+ 17 in FX);
in Liberica 21.0.13: 43 security fixes (+ 10 in FX) + 111 additional fixes (+ 17 in FX).
in Liberica 25.0.5: 44 security fixes (+ 10 in FX) + 154 additional fixes (+ 19 in FX);

in Liberica 27.0.1: 51 security fixes (+ 14 in FX) + 26 additional fixes (+ 23 in FX).

Download Liberica JDK

List of security issues fixed

CVE ID	cvss score	component	module	Attack vector (network/local)	Complexity (low/high)	Privileges (none/low)	User interaction (none/required)	Scope (changed/unchanged)	Confidentiality (low/none/high)	Integrity (low/none/high)	Availability (low/none/high)
CVE-2026-91398	6.8	core-libs	java.net	network	high	none	none	changed	none	high	none
CVE-2026-91382	6.5	client-libs	2d	network	high	none	none	unchanged	none	high	low
CVE-2026-91411	6.5	security-libs	org.ietf.jgss	network	high	none	none	unchanged	none	low	high
CVE-2026-87294	6.5	security-libs	java.security	network	low	none	none	unchanged	low	low	none
CVE-2026-91395	6.5	core-libs	java.util.jar	network	low	none	none	unchanged	none	low	low
CVE-2026-91396	6.5	core-libs	java.util.jar	network	low	none	none	unchanged	none	low	low
CVE-2026-91394	5.9	core-libs	java.net	network	high	none	none	unchanged	high	none	none
CVE-2026-83387	5.9	core-libs	java.sql	network	high	none	none	unchanged	high	none	none
CVE-2026-91462	5.9	security-libs	org.ietf.jgss	network	high	none	none	unchanged	none	high	none
CVE-2026-83374	5.9	security-libs	javax.crypto	network	high	none	none	unchanged	none	high	none
CVE-2026-87293	5.4	core-libs	java.rmi	network	high	none	none	changed	low	low	none
CVE-2026-91410	5.3	core-libs	java.nio	network	low	none	none	unchanged	none	none	low
CVE-2026-87291	5.3	core-libs	java.net	network	low	none	none	unchanged	low	none	none
CVE-2026-91332	5.3	core-libs	java.net	network	low	none	none	unchanged	none	low	none
CVE-2026-91451	5.3	core-libs	java.net	network	low	none	none	unchanged	none	low	none
CVE-2026-91373	5.3	security-libs	java.security	network	low	none	none	unchanged	none	none	low
CVE-2026-91417	5.3	other-libs	corba	network	low	none	none	unchanged	none	none	low
CVE-2026-83380	5.3	security-libs	javax.security	network	low	none	none	unchanged	low	none	none
CVE-2026-83400	5.3	xml	jaxp	network	low	none	none	unchanged	none	none	low
CVE-2026-91463	5.3	security-libs	org.ietf.jgss	network	high	none	required	unchanged	high	none	none
CVE-2026-91464	5.3	security-libs	org.ietf.jgss	network	high	none	required	unchanged	high	none	none
CVE-2026-91453	5.3	core-libs	java.net	network	low	none	none	unchanged	none	low	none
CVE-2026-91452	5.3	core-libs	java.net	network	low	none	none	unchanged	none	low	none
CVE-2026-91418	5.3	client-libs	javax.imageio	network	low	none	none	unchanged	none	none	low
CVE-2026-91487	4.8	hotspot	compiler	network	high	none	none	unchanged	low	low	none
CVE-2026-83381	4.8	security-libs	javax.security	network	high	none	none	unchanged	low	low	none
CVE-2026-91415	4.8	client-libs	2d	network	high	none	none	unchanged	low	low	none
CVE-2026-91374	4.8	core-svc	tools	network	high	none	none	unchanged	low	low	none
CVE-2026-91375	4.7	tools	jlink	local	high	none	required	unchanged	none	high	none
CVE-2026-91379	4.7	tools	jshell	local	high	none	required	unchanged	none	high	none
CVE-2026-91380	4.0	core-libs	java.util	local	high	none	none	unchanged	low	low	none
CVE-2026-83378	3.7	hotspot	compiler	network	high	none	none	unchanged	none	low	none
CVE-2026-87255	3.7	hotspot	compiler	network	high	none	none	unchanged	low	none	none
CVE-2026-91409	3.7	core-libs	java.net	network	high	none	none	unchanged	none	none	low
CVE-2026-91333	3.7	security-libs	javax.crypto	network	high	none	none	unchanged	none	low	none
CVE-2026-91381	3.7	client-libs	2d	network	high	none	none	unchanged	none	low	none
CVE-2026-91334	3.7	client-libs	javax.imageio	network	high	none	none	unchanged	low	none	none
CVE-2026-87290	3.7	xml	jaxp	network	high	none	none	unchanged	low	none	none
CVE-2026-87367	3.7	xml	jaxp	network	high	none	none	unchanged	none	low	none
CVE-2026-83395	3.7	core-libs	java.net	network	high	none	none	unchanged	none	low	none
CVE-2026-87292	3.7	core-libs	java.net	network	high	none	none	unchanged	none	low	none
CVE-2026-83376	3.7	security-libs	java.security	network	high	none	none	unchanged	none	low	none
CVE-2026-91461	3.7	security-libs	javax.net.ssl	network	high	none	none	unchanged	none	low	none
CVE-2026-91397	3.6	core-svc	tools	local	high	none	required	unchanged	none	low	low
CVE-2026-91400	3.1	client-libs	javax.sound	network	high	none	required	unchanged	none	none	low
CVE-2026-91335	2.6	client-libs	java.awt	network	high	low	required	unchanged	low	none	none
CVE-2026-43660	7.5	javafx	web	network	high	none	required	unchanged	high	high	high
CVE-2026-6732	5.9	javafx	libxml2	network	high	none	none	unchanged	none	none	high
CVE-2026-91385	5.4	javafx	web	network	low	none	required	unchanged	low	low	none
CVE-2026-46470	4.2	javafx	media	network	high	none	required	unchanged	low	none	low
CVE-2026-91402	3.1	javafx	graphics	network	high	none	required	unchanged	low	none	none
CVE-2026-91477	3.1	javafx	graphics	network	high	none	required	unchanged	low	none	none

Summary of fixes in Liberica JDK

CVEs fixed in Liberica per version:

CVE ID	6	7	8	11	17	21	25	27
CVE-2026-91398	●	●	●	●	●	●	●	●
CVE-2026-91382	●	●	●	●	●	●	●
CVE-2026-91411		●	●	●	●	●	●
CVE-2026-87294	●	●	●	●	●	●	●	●
CVE-2026-91395	●	●	●	●
CVE-2026-91396	●	●	●	●
CVE-2026-91394				●	●	●	●	●
CVE-2026-83387	●	●	●	●	●	●	●	●
CVE-2026-91462	●	●	●	●	●	●	●	●
CVE-2026-83374	●	●	●	●	●	●	●	●
CVE-2026-87293	●	●	●
CVE-2026-91410		●	●	●	●	●	●
CVE-2026-87291						●	●	●
CVE-2026-91332				●	●	●	●	●
CVE-2026-91451	●	●	●	●	●	●	●	●
CVE-2026-91373	●	●	●	●	●	●	●	●
CVE-2026-91417	●	●	●
CVE-2026-83380	●	●	●	●	●	●	●	●
CVE-2026-83400	●	●	●	●	●	●	●	●
CVE-2026-91463	●	●	●	●	●	●	●	●
CVE-2026-91464	●	●	●	●	●	●	●	●
CVE-2026-91453	●	●	●	●	●	●	●	●
CVE-2026-91452	●	●	●	●	●	●	●	●
CVE-2026-91418	●	●	●	●	●	●	●	●
CVE-2026-91487				●	●	●	●	●
CVE-2026-83381		●	●	●	●	●	●	●
CVE-2026-91415	●	●	●	●	●	●	●	●
CVE-2026-91374	●	●	●	●	●	●	●	●
CVE-2026-91375				●	●	●	●	●
CVE-2026-91379				●	●	●	●	●
CVE-2026-91380	●	●	●	●	●	●	●	●
CVE-2026-83378						●	●	●
CVE-2026-87255							●	●
CVE-2026-91409								●
CVE-2026-91333						●	●	●
CVE-2026-91381	●	●	●
CVE-2026-91334	●	●	●	●	●	●	●	●
CVE-2026-87290	●	●	●	●	●	●	●	●
CVE-2026-87367	●	●	●	●	●	●	●	●
CVE-2026-83395	●	●	●	●	●	●	●	●
CVE-2026-87292	●	●	●	●	●	●	●	●
CVE-2026-83376	●	●	●	●	●	●	●	●
CVE-2026-91461	●	●	●	●	●	●	●	●
CVE-2026-91397	●	●	●	●	●	●	●	●
CVE-2026-91400	●	●	●	●	●	●	●	●
CVE-2026-91335		●	●	●	●	●	●	●
CVE-2026-43660			●	●	●	●	●	●
CVE-2026-6732			●	●	●	●	●
CVE-2026-91385			●	●	●	●	●	●
CVE-2026-46470			●	●	●	●	●
CVE-2026-91402			●	●	●	●	●	●
CVE-2026-91477							●	●

Supported platforms

Liberica JDK is tested and proven to work on a large number of platforms.

Liberica JDK can be run in virtual and cloud environments. The following hypervisors are supported:

Docker
KVM
Microsoft Hyper-V (gen 1 and gen 2)
VirtualBox
VMware vSphere Hypervisor
Solaris Containers & Solaris LDOMs

Liberica JDK supports all major cloud providers, including but not limited to:

Amazon AWS
Digital Ocean
Google Cloud
Microsoft Azure
OVH
Packet
Scaleway
VMware Tanzu

Enjoy the most stable runtime!

The CPU release cycle enables the OpenJDK community to introduce security patches and bug fixes to Java as soon as possible, thus minimizing the risk of attacks on your applications. Download the new Liberica JDK builds now! Click on the button below to head over to Liberica Download Center.

Download Liberica JDK