Java (OpenJDK) on servers: LTS versions and updates

Updated November 2026

Run an LTS release (25 or 21, or 17 while it lasts), install each quarterly update within days, and restart every Java process. October 2026 brought three OpenJDK advisories: the regular update on October 20 and two out-of-band fixes on October 21 and 24 for compromised eMudhra CA certificates, each rated CVSS 9.1.

25Newest LTS (September 2025)
21Previous LTS (September 2023)
48OpenJDK CVEs fixed on Oct 20, 2026
Jan 19, 2027Next quarterly update

What it is

Java runs application servers such as Tomcat, build servers, search engines and many business apps. OpenJDK is the open-source Java platform; "JDKs" from Debian, Red Hat, Eclipse Adoptium (Temurin), Amazon (Corretto), Microsoft, Oracle and others are builds of the same source. Each vendor decides how long it ships updates for each version, so the vendor you install from sets your end-of-life date.

Supported LTS versions

A new feature release comes every six months. Since 2021, every second year one release is Long-Term Support (LTS): 8, 11, 17, 21 and 25 so far, with 29 planned for September 2027. Non-LTS releases are replaced six months later: Java 26 ended in September 2026, and Java 27 runs only until March 2027. Use LTS on servers.

End of updates by vendor, as of November 2026
Java	Temurin (at least)	Corretto	Microsoft (earliest)	RHEL stream	Oracle JDK (paid Extended)
25 LTS	Sep 2031	Oct 2032	Sep 2030	Dec 2030	Sep 2033
21 LTS	Dec 2029	Oct 2030	Sep 2028	Dec 2029	Sep 2031
17 LTS	Oct 2027	Oct 2029	Sep 2027	Dec 2027	Sep 2029
11 LTS	Oct 2027	Jan 2032	Sep 2027	ended Oct 2024	Jan 2032
8 LTS	Dec 2030	Dec 2030	(uses Temurin)	Nov 2026	Dec 2030
27	Mar 2027	Apr 2027			Premier to Mar 2027

RHEL dates apply to the java-*-openjdk streams on RHEL 8, 9 and 10 (Java 8 on RHEL 8 and 9 retires this month). Oracle JDK licensing differs by version: Oracle JDK 25 is free for all users under the Oracle No-Fee Terms and Conditions, with updates after September 2028 planned under the OTN license. Oracle JDK 21 updates from October 20, 2026 onward, like those for 8, 11 and 17, are under the OTN license, which is free only for personal and development use. If you run Oracle JDK 21 or older in production without a subscription, switch to an OpenJDK build of the same version or move to 25.

The quarterly patch schedule

OpenJDK publishes security fixes four times a year, on the third Tuesday of January, April, July and October. Oracle's Critical Patch Updates (CPUs) come on the same days. Vendors ship their builds on the day or soon after; Adoptium says Temurin binaries can take up to three weeks. Out-of-band fixes (outside the regular schedule) happen too: OpenJDK issued advisories on August 18, October 21 and October 24, 2026, and Temurin labels such updates with a fourth version number (for example 25.0.4.1).

Quarterly OpenJDK and Oracle update days (third Tuesday). Urgent fixes can arrive in between, as on October 21 and 24, 2026.

Put the next dates in your calendar and plan a restart window for each. Per-CVE details are on our vulnerability pages.

Check what you run

Servers often have several JDKs: a distro package, a vendor package, a tarball under /opt, and runtimes bundled inside applications. Check the one each service actually uses.

java -version
readlink -f "$(command -v java)"
update-alternatives --display java          # Debian/Ubuntu
alternatives --display java                 # RHEL/Fedora/SUSE
ps -eo pid,lstart,args | grep '[j]ava'      # running JVMs and their start time
sudo jcmd                                   # list JVMs (run as the JVM's user if it fails)
sudo jcmd 12345 VM.version                  # version of the JVM with PID 12345
sudo find / -xdev -type f -name java -perm -u+x 2>/dev/null   # all java binaries

Look at JAVA_HOME in each systemd unit or setenv.sh: a service pinned to an old path keeps using that JDK after you install a new one.

Distribution packages

Debian 13 ships openjdk-21 and openjdk-25, and Debian 12 ships openjdk-17. Their security archives carried the October 20 updates on November 3 (21.0.13, 25.0.5 and 17.0.21), but the Debian tracker still listed CVE-2026-114820 as open. Ubuntu's package archive still showed the August builds (for example 21.0.12.1) for 22.04, 24.04 and 26.04. RHEL ships java-17-openjdk, java-21-openjdk and java-25-openjdk. FreeBSD has java/openjdk17, java/openjdk21 and java/openjdk25.

sudo apt update && sudo apt install --only-upgrade 'openjdk-*'   # Debian/Ubuntu
sudo dnf upgrade --refresh 'java-*-openjdk*'                     # RHEL/Fedora
sudo zypper patch                                                # SUSE
sudo apk -U upgrade                                              # Alpine
sudo pkg upgrade -g 'openjdk*'                                   # FreeBSD

To switch the default java between installed versions, run sudo update-alternatives --config java (Debian/Ubuntu) or sudo alternatives --config java (RHEL family).

The eMudhra certificate fix

Private keys of eight eMudhra intermediate CA certificates were compromised. OpenJDK fixed this in CVE-2026-91403 and CVE-2026-114820. Its advice depends on how Java was installed:

Vendor builds (Temurin, tarballs): install an update whose release notes mention JDK-8395690 / CVE-2026-114820. Until then, back up lib/security/cacerts and remove the affected roots with keytool -delete -cacerts -alias "emsignrootcag1 [jdk]", and likewise for emsignrootcag2 [jdk], emsigneccrootcag3 [jdk] and comodoaaaca [jdk] (JDK 11 and later; on JDK 8 use -keystore $JDK_HOME/jre/lib/security/cacerts instead of -cacerts). Restart the JVMs.
RHEL, Fedora, Oracle Linux, Arch: Java uses the OS certificate store, so updating ca-certificates is likely enough.
Debian and Ubuntu: because of a bug in ca-certificates-java, rebuild the Java keystore after updating ca-certificates:

sudo apt update && sudo apt install --only-upgrade ca-certificates ca-certificates-java
sudo rm -f /etc/ssl/certs/java/cacerts
sudo update-ca-certificates --fresh
# then restart every Java service

FreeBSD's OpenJDK packages do not use the OS store; update the packages when fixed builds arrive. OpenJDK also provides a CheckCerts.java program to test a runtime.

Eclipse Temurin packages

Adoptium's repository gives the same Temurin builds on Debian, Ubuntu, RHEL, SUSE and Alpine. On Debian or Ubuntu:

sudo apt install -y wget apt-transport-https gpg
wget -qO - https://packages.adoptium.net/artifactory/api/gpg/key/public | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/adoptium.gpg > /dev/null
echo "deb https://packages.adoptium.net/artifactory/deb $(awk -F= '/^VERSION_CODENAME/{print$2}' /etc/os-release) main" | sudo tee /etc/apt/sources.list.d/adoptium.list
sudo apt update
sudo apt install temurin-21-jdk          # or temurin-25-jre for a runtime only
sudo apt install --only-upgrade 'temurin-*'   # later updates

On RHEL, SUSE and Alpine, follow Adoptium's Linux installation page, then update with dnf, zypper or apk as usual. As of November 3, Temurin had published 25.0.5, 21.0.13 and 17.0.21 (October 22) and 27.0.1.0.2 (October 24); the October builds for 8 and 11 (8u511, 11.0.33) were still listed as due.

Containers

Pin the major version and rebuild after each update, for example FROM eclipse-temurin:25-jre or eclipse-temurin:21-jre-alpine:

docker build --pull -t myapp:latest .
docker compose build --pull && docker compose up -d     # recreates containers
docker compose exec app java -version

See Containers.

Restart and verify

A running JVM keeps the old libjvm.so and classes until it restarts. Restart each Java service, then confirm:

sudo systemctl restart myapp.service                 # restarts the app
ps -eo pid,lstart,args | grep '[j]ava'               # start times after the update
sudo lsof -n 2>/dev/null | grep 'libjvm.so.*(deleted)'   # JVMs still on the old library

See Restarts and reboots.

Security advisories

OpenJDK Vulnerability Advisories and the vuln-announce mailing list.
Oracle Critical Patch Updates and Security Alerts, with an RSS feed and email subscription.
Your vendor's release notes (for example Temurin release notes) and your distribution's tracker. See Security advisories.

Hardening tips

Install a JRE or headless package on servers, not a full JDK, unless you build there.
Run each Java service as its own unprivileged user.
Never expose remote debugging (-agentlib:jdwp) or unauthenticated JMX ports to a network.
Remove old JDKs and bundled runtimes you no longer use.
Set JAVA_HOME to a version-neutral path or alternatives link so updates take effect.
Scan application JARs for vulnerable libraries; most Java breaches come from libraries, not the JVM.

On an end-of-life version

Java 26 and older non-LTS versions get no more fixes: move to 25. Java 11 and 17 builds from Temurin and Microsoft end around September to October 2027, so plan the move to 21 or 25 now. Corretto and Oracle (paid Extended Support) cover 11 and 17 longer if you cannot move in time. See Is my OS supported?.