JDK 17.0.21.0.2 Release Notes
Java™ SE Development Kit 17, Update 17.0.21.0.2 (JDK 17.0.21.0.2)
Release date: October 21, 2026
The full version string for this update release is 17.0.21.0.2+1 (where "+" means "build"). The version number is 17.0.21.0.2. This JDK conforms to version 17.1 of the Java SE Specification (JSR 392 MR 1 2024-07-02).
IANA TZ Data 2026e
JDK 17.0.21.0.2 contains IANA time zone data 2026e which contains the following changes:
- Manitoba moves to permanent -05 on 2026-10-31.
- Canada’s Northwest Territories moved to permanent -06 on 2026-08-21.
For more information, refer to Timezone Data Versions in the JRE Software.
Security Baselines
The security baselines for the Java Runtime Environment (JRE) at the time of the release of JDK 17.0.21.0.2 are specified in the following table:
| JRE Family Version | JRE Security Baseline (Full Version String) |
|---|---|
| 17 | 17.0.21.0.2+1 |
| 11 | 11.0.33.0.2+1 |
| 8 | 1.8.0_511-b32 |
Keeping the JDK up to Date
Oracle recommends that the JDK is updated with each Critical Patch Update. In order to determine if a release is the latest, the Security Baseline page can be used to determine which is the latest version for each release family.
Critical patch updates, which contain security vulnerability fixes, are announced one year in advance on Critical Patch Updates, Security Alerts and Bulletins. It is not recommended that this JDK (version 17.0.21.0.2) be used after the next critical patch update scheduled for November 17, 2026.
Java Management Service, available to all users, can help you find vulnerable Java versions in your systems. Java SE Subscribers and customers running in Oracle Cloud can use Java Management Service to update Java Runtimes and to do further security reviews like identifying potentially vulnerable third party libraries used by your Java programs. Existing Java Management Service user click here to log in to your dashboard. The Java Management Service Documentation provides a list of features available to everyone and those available only to customers. Learn more about using Java Management Service to monitor and secure your Java Installations.
Other Notes
The JDK has stopped trusting the eMudhra intermediate CA certificates that have been compromised. For more details on this issue, see https://emudhra.we-have-a-problem.com/. The distrust includes 8 eMudhra intermediate CA certificates and 8 certificates cross-signed by Sectigo.
The certificates have been blocked by adding them to the lib/security/blocked.certs file.
For TLS applications, a TLS session will not be negotiated if the server's certificate chain contains one of the compromised certificates.
For signed code, verifying a signed JAR with the command jarsigner -verify -strict $SIGNED_JAR will fail if the JAR was signed with a certificate chain containing one of the compromised certificates.
Fixes
This release also contains the fix for the security vulnerability described in the Oracle Security Alert Advisory - CVE-2026-91403.
➜ Issues fixed in 17.0.21.0.2:| # | JBS | Component/Subcomponent | Summary |
|---|---|---|---|
| 1 | JDK-8392377 | core-libs/java.time | (tz) Update Timezone Data to 2026d |
| 2 | JDK-8392519 | core-libs/java.util:i18n | Cherry-pick metazone changes from CLDR for tzdata2026d, for JDK update release |
| 3 | JDK-8392526 | core-libs/java.util:i18n | Cherry-pick BCP 47 time zone changes from CLDR for tzdata2026d, for JDK update releases |
| 4 | JDK-8343788 | core-libs/java.util:i18n | Provide means to alter lib/tzmappings entries on Windows |
| 5 | JDK-8393337 | core-libs/java.time | (tz) Update Timezone Data to 2026e |
| 6 | JDK-8393344 | core-libs/java.util:i18n | Cherry-pick metazone changes from CLDR to support tzdata2026e for JDK update releases |
| 7 | JDK-8392538 | core-libs/java.util:i18n | Align the JDK with Microsoft's new timezone names for British Columbia/Alberta |
| 8 | JDK-8393848 | core-libs/java.util:i18n | Align the JDK with Microsoft's new timezone name for Manitoba |