The following sections summarize changes made in all Java SE 17.0.9 BPR releases. The BPR releases are listed below in date order, most current BPR first. Note that bug fixes in previous BPRs are also included in the current BPR.
The system property,
jdk.jar.maxSignatureFileSize, allows applications to control the maximum size of signature files in a signed JAR. Its default value has been increased from 8000000 bytes (8 MB) to 16000000 bytes (16 MB).
|Increase jdk.jar.maxSignatureFileSize default which is too low for JARs such as WhiteSource/Mend unified agent jar
|JDK-8309489 (not public)
|17.0.7/11.0.19 and later fail to run jar file via UNC path when using .exe files under javapath
|JDK-8317121 (not public)
|vector_masked_load instruction is moved too early after JDK-8286941
The full version string for this update release is 17.0.9+11 (where "+" means "build"). The version number is 17.0.9.
For more information, refer to Timezone Data Versions in the JRE Software.
The security baselines for the Java Runtime Environment (JRE) at the time of the release of JDK 17.0.9 are specified in the following table:
|JRE Family Version
|JRE Security Baseline (Full Version String)
Oracle recommends that the JDK is updated with each Critical Patch Update. In order to determine if a release is the latest, the Security Baseline page can be used to determine which is the latest version for each release family.
Critical patch updates, which contain security vulnerability fixes, are announced one year in advance on Critical Patch Updates, Security Alerts and Bulletins. It is not recommended that this JDK (version 17.0.9) be used after the next critical patch update scheduled for January 16, 2024.
-XshowSettings:locale Output Now Includes Tzdata Version
-XshowSettings launcher option has been enhanced to print the tzdata version configured with the JDK. The tzdata version is displayed as part of the
locale showSettings option.
Example output using
default locale = English
default display locale = English
default format locale = English
tzdata version = 2023c
The following root certificate from SECOM Trust System has been removed from the
+ alias name "secomscrootca1 [jdk]"
Distinguished Name: OU=Security Communication RootCA1, O=SECOM Trust.net, C=JP
The following root certificate has been added to the cacerts truststore:
+ Certigna (Dhimyotis)
DN: CN=Certigna Root CA, OU=0002 48146308100036, O=Dhimyotis, C=FR
The JDK implementation of TLS 1.2 now uses a default Diffie Hellman keysize of 2048 bits when a TLS_DHE cipher suite is negotiated and either the client or server does not support FFDHE, which can negotiate a stronger keysize. The JDK TLS implementation supports FFDHE and it is enabled by default.
As a workaround, users can revert to the previous size by setting the
jdk.tls.ephemeralDHKeySize system property to 1024 (at their own risk).
This change does not affect TLS 1.3 as the minimum DH group size is already 2048 bits.
This release also contains fixes for security vulnerabilities described in the Oracle Critical Patch Update.
➜ Issues fixed in 17.0.9:
|On the latest macOS+XCode the Robot API may report wrong colors
|Update FreeType to 2.13.0
|Update HarfBuzz to 7.2.0
|Ideographic characters aren't stretched by AffineTransform.scale(2, 1)
|Linux: NullPointerException from FontConfiguration.getVersion in case no fonts are installed
|Wrong visible amount in Adjustable of ScrollPane
|ScrollPane insets are incorrect
|java.awt.ScrollPane broken after multiple scroll up/down
|Update Libpng to 1.6.39
|Application freezes when copying an animated gif image to the system clipboard
|Exception printed to stdout on Windows when storing transparent image in clipboard
|Files.readString ignores encoding errors for UTF-16
|Files.writeString fails to throw IOException for charset "windows-1252"
|java/util/concurrent/ConcurrentHashMap/ConcurrentAssociateTest.java fails with internal timeout when executed with TieredCompilation1/3
|Invalid CEN header (invalid zip64 extra data field size)
|Matcher.hitEnd returns unexpected results in presence of CANON_EQ flag.
|Refactor TestMemoryAwareness to use WhiteBox api for host values
|Corrupted heap dumps due to missing retries for os::write()
|Implement fast-path for ASCII-compatible CharsetEncoders on aarch64
|Improve performance of CRC32C intrinsics (non-AVX-512) for small inputs
|AArch64: Handle special cases for MaxINode & MinINode
|emit abstract machine code in hs-err logs
|Error in parsing replay file when staticfield is an array of single dimension
|C2: assert(final_con == (jlong)final_int) failed: final value should be integer
|Accelerate AVX-512 CRC32C for small buffers
|max code printed in hs-err logs should be configurable
|C1: Missing receiver null check in Reference::get intrinsic
|Correct type/array element offset in LibraryCallKit::get_state_from_digest_object()
|Improve MD5 intrinsic on AArch64
|Investigate and improve instruction cache flushing during compilation
|SIGSEGV in Method::is_method_handle_intrinsic
|C2 Blackholes should allow load optimizations
|Unsafe.allocateInstance should be intrinsified without UseUnalignedAccesses
|Major performance regression in Math.log on aarch64
|AArch64: Vector registers are clobbered by some macroassemblers
|G1: Full gc mark stack draining should prefer to make work available to other threads
|Incorrect value of 'used' jvmstat counter
|Memory leak in BitSet::BitMapFragmentTable in JFR leak profiler
|JFR: Memory leak in dcmd_arena
|[JFR] Better handling of tampered JFR repository
|Unsafe list operations in JfrStringPool
|Correctly update line maps when class redefine rewrites bytecodes
|RunThese30M.java crashed with assert(early->flag() == current->flag() || early->flag() == mtNone)
|Thread.isAlive0 doesn't need to call into the VM
|Factor out the common code for initializing and starting internal VM JavaThreads
|Dangling reference in ClassVerifier::verify_class
|Make thread stacks not use huge pages
|Show stack dimensions in UL logging when attaching threads
|AsyncGetCallTrace may crash JVM on guarantee
|perfMemory_windows.cpp add free_security_attr to early returns
|SA: Allow larger object alignments
|javac regression: Compilation with --release 8 fails on underscore in enum identifiers
|Incorrect line number reported in exception stack trace thrown from a lambda expression
|javadoc throws NPE with --ignore-source-errors option