Two new switches, -XX:+ErrorFileToStdout and -XX:+ErrorFileToStderr, have been added. When either switch is specified and a fatal error occurs, the JVM redirects the crash report content that would normally be written to the hs_err file to stdout or stderr, respectively.

All TLS server certificates anchored by Symantec, Entrust, and Camerfirma root CAs are now distrusted, regardless of their issuing date. TLS server certificates anchored by Chunghwa root CAs will be completely distrusted as of April 19, 2027. The jdk.security.caDistrustPolicies security property in the java.security configuration file has been updated to reflect these new policies.

The com.sun.net.http.HttpServer has been updated to validate the Host request header as described in RFC 9112. HTTP/1.1 requests without a Host header or with multiple Host headers are now rejected with an HTTP 400 Bad Request response.

The validation can be disabled by setting the system property sun.net.httpserver.disableHostValidation to true.

The implementation of the WebRowSet.readXml methods has been updated to consistently report XML parsing and validation failures as SQLException.

WebRowSet.readXml validates XML input against the standard WebRowSet XML schema. Applications should expect malformed XML, schema validation failures, unsupported external entities, and other XML processing errors to be reported as SQLException. Validation can be disabled by setting the system property jdk.sql.rowset.webrowsetValidation to false.

The existing method signatures remain unchanged. No specification changes are included in this update.

The scope of the com.sun.jndi.ldap.object.trustSerialData system property is extended to cover transparent processing of URL RMI References obtained from an LDAP context.

A URL context factory is a special type of ObjectFactory that will be used to look up an object referred to from a JNDI javax.naming.Reference that does not specify any factory name, but contains a simple reference address in the form of a URL string. When deserialization of Java objects from LDAP is disabled, the JDK built-in implementation of the JNDI/LDAP provider will no longer transparently use any URL context factory when processing Reference objects containing a URL reference whose scheme is rmi.

To make it possible to have a finer-grain control over which URL schemes should be disabled when processing URL string reference addresses from the built-in JNDI/LDAP provider, a new system property, jdk.jndi.ldap.disabledURLSchemes, is introduced. The value of this property is a comma-separated list of URL schemes that are disabled. The JDK built-in implementation of the JNDI/LDAP provider will no longer transparently use any URL context factory when processing Reference objects containing a URL reference whose scheme corresponds (case insensitively) to one of the schemes in this list of disabled schemes. The default value for that property is "rmi" if trustSerialData is false (the default), and empty if trustSerialData is true. If a custom value for this new property is provided on the Java command line then only schemes listed in that property value are disabled, regardless of the value of trustSerialData.

If rmi is included in this list (the default when no custom values have been supplied for com.sun.jndi.ldap.object.trustSerialData or jdk.jndi.ldap.disabledURLSchemes), then a javax.naming.Reference object will be returned to the application instead of the object that would have been created by processing the RMI reference and looking up its URL from the context returned by a URL context factory.

An application that depends on following RMI URLs contained in a Reference obtained from a JNDI/LDAP context may need to process the Reference object explicitly, or provide a custom value for the jdk.jndi.ldap.disabledURLSchemes system property that does not include the rmi scheme.

An application that wants to prevent transparent processing of other kinds of URL schemes can now do so by supplying a custom value for the jdk.jndi.ldap.disabledURLSchemes system property that also includes them.

The following root certificate has been removed from the cacerts keystore:

+ alias name "luxtrustglobalrootca [jdk]"

  Distinguished Name: CN=LuxTrust Global Root, O=LuxTrust s.a., C=LU

The way JShell's remote agents are invoked has changed. Existing agents will need to be updated to use the new protocol. See the jdk.jshell.execution.RemoteExecutionControl JavaDoc API documentation for the new protocol.

Deserialization of the com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl class is now disabled by default. (This is an internal class that implements the javax.xml.transform.Templates interface.) An application attempting to deserialize an instance of this class will receive UnsupportedOperationException. To re-enable deserialization of this class, use the command line to set the system property jdk.xml.enableTemplatesImplDeserialization to true. Prior to this change, deserialization was enabled by default, unless the Security Manager was enabled. The state of the Security Manager is no longer considered in determining whether deserialization is enabled.

This release also contains fixes for security vulnerabilities described in the Oracle Critical Patch Update.