JDK 17.0.8 Release Notes

Java SE 17.0.8 - Bundled Patch Release (BPR) - Bug Fixes and Updates

The following sections summarize changes made in all Java SE 17.0.8 BPR releases. The BPR releases are listed below in date order, most current BPR first. Note that bug fixes in previous BPRs are also included in the current BPR.


Changes in Java SE

Bug Fixes

BugId Category Subcategory Description
JDK-8313765 core-libs java.util.jar Invalid CEN header (invalid zip64 extra data field size)
JDK-8232933 tools javac Javac inferred type does not conform to equality constraint

Java™ SE Development Kit 17, Update 17.0.8 (JDK 17.0.8)

July 18, 2023

The full version string for this update release is 17.0.8+9 (where "+" means "build"). The version number is 17.0.8.


IANA TZ Data 2023c

JDK 17.0.8 contains IANA time zone data 2023c which contains the following changes:

  • Egypt now uses DST again, from April through October.
  • This year Morocco springs forward April 23, not April 30.
  • Palestine delays the start of DST this year.
  • Much of Greenland still uses DST from 2024 on.
  • America/Yellowknife now links to America/Edmonton.
  • tzselect can now use current time to help infer timezone.
  • The code now defaults to C99 or later.
  • Fix use of C23 attributes.
  • This release's code and data are identical to 2023a.

For more information, refer to Timezone Data Versions in the JRE Software.


Security Baselines

The security baselines for the Java Runtime Environment (JRE) at the time of the release of JDK 17.0.8 are specified in the following table:

JRE Family Version JRE Security Baseline (Full Version String)


Keeping the JDK up to Date

Oracle recommends that the JDK is updated with each Critical Patch Update. In order to determine if a release is the latest, the Security Baseline page can be used to determine which is the latest version for each release family.

Critical patch updates, which contain security vulnerability fixes, are announced one year in advance on Critical Patch Updates, Security Alerts and Bulletins. It is not recommended that this JDK (version 17.0.8) be used after the next critical patch update scheduled for October 17, 2023.


New Features

 Support for GB18030-2022 (JDK-8307229)

The China National Standard body (CESI) has recently published GB18030-2022, which is an updated version of the GB18030 standard and brings GB18030 in sync with Unicode version 11.0. The Charset implementation for this new standard has now replaced the prior 2000 standard. However, this new standard has some incompatible changes from the prior implementation. For those who need to use the old mappings, a new system property, jdk.charset.GB18030, is introduced. By setting its value to 2000, the previous JDK releases' mappings for the GB18030 Charset are used, which are based on the 2000 standard.

 Windows KeyStore Updated to Include Access to the Local Machine Location (JDK-6782021)

The Windows KeyStore support in the SunMSCAPI provider has been expanded to include access to the local machine location. The new keystore types are:


The following keystore types were also added, allowing developers to make it clear they map to the current user:

  • "Windows-MY-CURRENTUSER" (same as "Windows-MY")
  • "Windows-ROOT-CURRENTUSER" (same as "Windows-ROOT")

 New JFR Event: jdk.SecurityProviderService (JDK-8254711)

A new Java Flight Recorder (JFR) event has been added to record details of type, String algorithm) calls.

The new event name is jdk.SecurityProviderService and contains the following fields:

Field name Field Description
type Type of Service
algorithm Algorithm Name
provider Security Provider

This event is disabled by default and can be enabled via the JFR configuration files or via standard JFR options.


Known Issues

 Problem Upgrading JDK on Windows if System User Is Using Shared Files (JDK-8310932 (not public))

Installing into the same, shared jdk-(family) directory is the default behavior for the JDK starting with the July 2023 CPU. It could lead to FilesInUse issues if JDK files are locked by the "System User". We recommend shutting down any apps using the JDK as the "System User" before upgrading.


Other Notes

 System Property to Turn off JDK-8251329 Restrictions (JDK-8302992)

A new system property, jdk.nio.zipfs.allowDotZipEntry, has been introduced. This system property can be used to remove the newly added restrictions in the Zip FS provider, which currently rejects ZIP files that contain entries with "." or ".." in name elements by default. Refer to the CSR for more detail.

 Debian JDK Installer Changes (JDK-8284854)

The installation directory of Oracle JDK Debian package has changed from /usr/lib/jvm/jdk-${FEATURE} to /usr/lib/jvm/jdk-${FEATURE}-oracle-${ARCH}.

The Oracle JDK Debian package registers jexec as an interpreter for launching .jar files from the command line.

The Oracle JDK Debian package configures storage for Java Preferences API in /etc/.java/.systemPrefs directory.

The Oracle JDK Debian package registers JDK commands with update-alternatives command and supplies /usr/lib/jvm/.jdk-${FEATURE}-oracle-${ARCH}.jinfo file for update-java-alternatives command.

 Missing /usr/java/default Symlink on Linux Restored (JDK-8306690)

A regression where the /usr/java/default symlink is not created by RPM installers on Linux platforms has been fixed. Installers will create the /usr/java/default symlink if it doesn't exist, targeting the /usr/java/latest symlink.

 Installation of JDK RPM Corrupts Alternatives (JDK-8308244)

The JDK RPM installer will remove incorrectly constructed entries of "java" and "javac" groups registered by older Oracle JDK RPM installers from the alternatives before registering new "java" and "javac" entries.

An incorrectly constructed entry of the "java" group contains commands that are supposed to belong to the "javac" group.

An incorrectly constructed entry of the "javac" group contains commands that are supposed to belong to the "java" group.

All incorrectly constructed entries belonging to Oracle JDK RPM packages will be removed from the alternatives to avoid corruption of the alternatives internal data.

The removal has a potential side effect for users who have installed multiple JDK versions that are not updated to the latest release. Commands from a removed "java" or "javac" group are now unavailable for system Java switch, which potentially changes the current system Java without a warning. For example, if there is an out-of-date JDK RPM from an 11+ release, say 11.0.17, with an incorrectly constructed single "java" group installed and 8u381 RPM with this patch is installed, it will remove an entry from the "java" group belonging to the 11.0.17 RPM and thus will switch the current system Java from 11.0.17 to 8u381. The side effect will only happen when you install a lower JDK family with the fix, such as 8u381, and there is an out-of-date JDK from a higher family, such as 11.0.17, installed on the system. In that case, 8u381 will replace the older 11.0.17 as the latest. The remedy for the user is to install the latest JDK 11.

 Added TWCA Root CA Certificate (JDK-8305975)

The following root certificate has been added to the cacerts truststore:


  + twcaglobalrootca
    DN: CN=TWCA Global Root CA, OU=Root CA, O=TAIWAN-CA, C=TW

 Added 4 GTS Root CA Certificates (JDK-8307134)

The following root certificates have been added to the cacerts truststore:

+ Google Trust Services LLC

 + gtsrootcar1
  DN: CN=GTS Root R1, O=Google Trust Services LLC, C=US

+ Google Trust Services LLC
 + gtsrootcar2
  DN: CN=GTS Root R2, O=Google Trust Services LLC, C=US

+ Google Trust Services LLC
 + gtsrootecccar3
  DN: CN=GTS Root R3, O=Google Trust Services LLC, C=US

+ Google Trust Services LLC
 + gtsrootecccar4
  DN: CN=GTS Root R4, O=Google Trust Services LLC, C=US

 Added Microsoft Corporation's 2 TLS Root CA Certificates (JDK-8304760)

The following root certificates have been added to the cacerts truststore:

+ Microsoft Corporation

  + microsoftecc2017
    DN: CN=Microsoft ECC Root Certificate Authority 2017, O=Microsoft Corporation, C=US

+ Microsoft Corporation
  + microsoftrsa2017
    DN: CN=Microsoft RSA Root Certificate Authority 2017, O=Microsoft Corporation, C=US

 GregorianCalender.computeTime() JVM Crash (JDK-8308884)

A virtual machine crash was observed in JDK 11.0.19 and 17.0.7 when executing the GregorianCalender.computeTime() method (JDK-8307683). It was found that although the root cause of the crash is an old issue, a recent fix for a rare issue in the C2 compiler (JDK-8297951) made the crash much more likely. To mitigate this, the fix has been reverted in JDK 11.0.20 and 17.0.8 and will be reapplied once JDK-8307683 is resolved.

 ASLR Support for CDS Archive (JDK-8294323 (not public))

Starting with the July 2023 CPU, on operating systems where ASLR (Address Space Layout Randomization) is enabled, the CDS archive will be placed at a random address picked by the operating system.

This change may have a minor performance impact: (a) Start-up time may increase because the JVM needs to patch pointers inside the CDS archive. (b) Memory usage may increase because the memory used by the CDS archive is no longer shareable across processes. We expect the impact to be small because such increases should be only a small fraction of the overall application usage.

In the unlikely event that you must disable ASLR for CDS, you can use the JVM flags -XX:+UnlockDiagnosticVMOptions -XX:ArchiveRelocationMode=0. The usage of such flags is not recommended.

 New System Property to Control the Maximum Size of Signature Files (JDK-8300596 (not public))

A new system property, jdk.jar.maxSignatureFileSize, has been added to allow applications to control the maximum size of signature files in a signed JAR. The value of the system property is the desired size in bytes. The default value is 8000000 bytes.

 Improved ZIP64 Extra Field Validation (JDK-8302483 (not public)) has been updated to provide additional validation of ZIP64 extra fields when opening a ZIP file. This validation may be disabled by setting the system property to true.


Bug Fixes

This release also contains fixes for security vulnerabilities described in the Oracle Critical Patch Update.

Issues fixed in 17.0.8:

# JBS Component Summary
1JDK-8297241client-libs/2dUpdate sun/java2d/DirectX/OnScreenRenderingResizeTest/
2JDK-8022403client-libs/2dsun/java2d/DirectX/OnScreenRenderingResizeTest/ fails
3JDK-8301998client-libs/2dUpdate HarfBuzz to 7.0.1
4JDK-8288854client-libs/java.awtgetLocalGraphicsEnvironment() on for multi-screen setups throws exception NPE
5JDK-8302151client-libs/javax.imageioBMPImageReader throws an exception reading BMP images
6JDK-8227257client-libs/javax.swingjavax/swing/JFileChooser/4847375/ fails with AssertionError
7JDK-8283059core-libsUninitialized warning in check_code.c with GCC 11.2
8JDK-8275735core-libs[linux] Remove deprecated Metrics api (kernel memory limit)
9JDK-8286287core-libs/java.langReading file as UTF-16 causes Error which "shouldn't happen"
10JDK-8291638core-libs/java.netKeep-Alive timeout of 0 should close connection immediately
11JDK-8291637core-libs/java.netHttpClient default keep alive timeout not followed if server sends invalid value
12JDK-8287162core-libs/java.nio(zipfs) Performance regression related to support for POSIX file permissions
13JDK-8301119core-libs/java.nio.charsetsSupport for GB18030-2022
14JDK-8295564core-libs/java.textNorwegian Nynorsk Locale is missing formatting
15JDK-8301216core-libs/java.util.concurrentForkJoinPool invokeAll() ignores timeout
16JDK-8282227core-libs/java.util:i18nLocale information for nb is not working properly
17JDK-8305400core-libs/java.util:i18nISO 4217 Amendment 175 Update
18JDK-8275721core-libs/java.util:i18nName of UTC timezone in a locale changes depending on previous code
19JDK-8293540core-svc[Metrics] Incorrectly detected resource limits with additional cgroup fs mounts
20JDK-8256811core-svc/debuggerDelayed/missed jdwp class unloading events
21JDK-8280007hotspot/compilerEnable Neoverse N1 optimizations for Arm Neoverse V1 & N2
22JDK-8299179hotspot/compilerArrayFill with store on backedge needs to reduce length by 1
23JDK-8302595hotspot/compileruse-after-free related to GraphKit::clone_map
24JDK-8299959hotspot/compilerC2: CmpU::Value must filter overflow computation against local sub computation
25JDK-8303564hotspot/compilerC2: "Bad graph detected in build_loop_late" after a CMove is wrongly split thru phi
26JDK-8303508hotspot/compilerVector.lane() gets wrong value on x86
27JDK-8299570hotspot/compiler[JVMCI] Insufficient error handling when CodeBuffer is exhausted
28JDK-8300079hotspot/compilerSIGSEGV in LibraryCallKit::inline_string_copy due to constant NULL src argument
29JDK-8299259hotspot/compilerC2: Div/Mod nodes without zero check could be split through iv phi of loop resulting in SIGFPE
30JDK-8296318hotspot/compileruse-def assert: special case undetected loops nested in infinite loops
31JDK-8296412hotspot/compilerSpecial case infinite loops with unmerged backedges in IdealLoopTree::check_safepts
32JDK-8297730hotspot/compilerC2: Arraycopy intrinsic throws incorrect exception
33JDK-8301491hotspot/compilerC2: java.lang.StringUTF16::indexOfChar intrinsic called with negative character argument
34JDK-8303588hotspot/compiler[JVMCI] make JVMCI source directories conform with standard layout
35JDK-8201516hotspot/compilerDebugNonSafepoints generates incorrect information
36JDK-8302508hotspot/compilerAdd timestamp to the output TraceCompilerThreads
37JDK-8289748hotspot/compilerC2 compiled code crashes with SIGFPE with -XX:+StressLCM and -XX:+StressGCM
38JDK-8303511hotspot/compilerC2: assert(get_ctrl(n) == cle_out) during unrolling
39JDK-8291456hotspot/jvmticom/sun/jdi/ failed with: Wrong number of class unload events: expected 10 got 4
40JDK-8280784hotspot/runtimeVM_Cleanup unnecessarily processes all thread oops
41JDK-8294677hotspot/runtimechunklevel::MAX_CHUNK_WORD_SIZE too small for some applications
42JDK-8277946hotspot/runtimeNMT: Remove VM.native_memory shutdown jcmd command option
43JDK-8301123hotspot/runtimeEnable Symbol refcounting underflow checks in PRODUCT
44JDK-8295974hotspot/runtimejni_FatalError and Xcheck:jni warnings should print the native stack when there are no Java frames
45JDK-8287007hotspot/runtime[cgroups] Consistently use stringStream throughout parsing code
46JDK-8278965hotspot/runtimecrash in SymbolTable::do_lookup
47JDK-8301749hotspot/runtimeTracking malloc pooled memory size
48JDK-8213059install/installJava .deb package implementation is incomplete
49JDK-8293858security-libs/java.securityChange PKCS7 code to use default SecureRandom impl instead of SHA1PRNG
50JDK-8280703security-libs/javax.cryptoCipherCore.doFinal(...) causes potentially massive byte[] allocations during decryption
51JDK-8294906security-libs/javax.crypto:pkcs11Memory leak in PKCS11 NSS TLS server
52JDK-8296329tools/jarjar validator doesn't account for minor class file version
53JDK-8278834tools/javacError "Cannot read field "sym" because "this.lvar[od]" is null" when compiling
54JDK-8297587tools/jshellUpgrade JLine to 3.22.0
55JDK-8280373xml/javax.xml.parsersUpdate Xalan serializer / SystemIDResolver to align with JDK-8270492
56JDK-8301269xml/jaxpUpdate Commons BCEL to Version 6.7.0