JDK 21.0.12 Release Notes
Java™ SE Development Kit 21, Update 21.0.12 (JDK 21.0.12)
Release date: July 21, 2026
The full version string for this update release is 21.0.12+7 (where "+" means "build"). The version number is 21.0.12. This JDK conforms to version 21 of the Java SE Specification (JSR 396 2023-09-19).
IANA TZ Data 2026b
JDK 21.0.12 contains IANA time zone data 2026b which contains the following changes:
- British Columbia last daylight saving time change was 2026-03-08 spring forward.
For more information, refer to Timezone Data Versions in the JRE Software.
Security Baselines
The security baselines for the Java Runtime Environment (JRE) at the time of the release of JDK 21.0.12 are specified in the following table:
| Java Family Version | Security Baseline (Full Version String) |
|---|---|
| 21 | 21.0.12+7 |
| 17 | 17.0.20+7 |
| 11 | 11.0.32+7 |
| 8 | 1.8.0_501-b08 |
Keeping the JDK up to Date
Oracle recommends that the JDK is updated with each Critical Patch Update. In order to determine if a release is the latest, the Security Baseline page can be used to determine which is the latest version for each release family.
Critical patch updates, which contain security vulnerability fixes, are announced one year in advance on Critical Patch Updates, Security Alerts and Bulletins. It is not recommended that this JDK (version 21.0.12) be used after the next Critical Security Patch Update scheduled for August 18, 2026. Oracle is transitioning to more frequent security updates, see the recently published blog for more information.
Java Management Service, available to all users, can help you find vulnerable Java versions in your systems. Java SE Subscribers and customers running in Oracle Cloud can use Java Management Service to update Java Runtimes and to do further security reviews like identifying potentially vulnerable third party libraries used by your Java programs. Existing Java Management Service user click here to log in to your dashboard. The Java Management Service Documentation provides a list of features available to everyone and those available only to customers. Learn more about using Java Management Service to monitor and secure your Java Installations.
Availability of Oracle JDK 21 under NFTC
Oracle JDK 21 LTS, released in September 2023, has been permissively licensed under the free Java license and will continue to be so until one year after the subsequent LTS release. Oracle designated Oracle JDK 25, released in September of 2025, as a Long Term Support (LTS) release. Therefore, update releases of Oracle JDK 21 after September of 2026 will switch to the Java SE OTN license, the same license under which we offer updates to Java 8, 11, and 17. Users wishing to receive updates of the Oracle JDK under the free Java license should migrate to Oracle JDK 25.
A similar licensing change will take effect for JavaFX 21 updates released after September 2026.
Other Notes
The following root certificates have been added to the cacerts truststore:
+ WISeKey
+ wisekeyglobalrootgbca
DN: CN=OISTE WISeKey Global Root GB CA, OU=OISTE Foundation Endorsed, O=WISeKey, C=CH
+ WISeKey
+ wisekeyglobalrootgcca
DN: CN=OISTE WISeKey Global Root GC CA, OU=OISTE Foundation Endorsed, O=WISeKey, C=CH
The DTLS implementation in the SunJSSE security provider has been enhanced to generate HelloVerifyRequest cookies as recommended by RFC 6347. To use this feature, applications must create the SSLEngine with the SSLContext.createSSLEngine(String peerHost, int peerPort) API.
A new system and security property, com.sun.security.crl.maxSize, has been added to limit the maximum length of a CRL that is downloaded through URIs in the CRL Distribution Points certificate extension during path validation. The value of these properties is the size in bytes of the DER-encoded CRL. For protocols that can return multivalue responses, such as LDAP, the size threshold is the sum of all CRLs downloaded from a single search query. CRLs that exceed this length will not be processed during certificate path validation. This size limit does not apply to CRLs that are imported through non-network-based means. A negative value disables this size limitation. A non-numeric value will be ignored, and the default size will be used instead. The default size limit is 20 MiB. For cases where both the security and system properties are set, the system property takes precedence. Enabling certificate path logging by setting java.security.debug=certpath will output the current size limit and note any discarded CRLs.
Fixes
This release also contains fixes for security vulnerabilities described in the Oracle Critical Patch Update.
➜ Issues fixed in 21.0.12:| # | JBS | Component/Subcomponent | Summary |
|---|---|---|---|
| 1 | JDK-8369561 | client-libs/2d | sun/java2d/OpenGL/DrawBitmaskImage.java#id0: Incorrect color for first pixel (actual=ff000000) |
| 2 | JDK-8378201 | client-libs/2d | [OGL] glXMakeContextCurrent() drops the buffers of the unbound drawable |
| 3 | JDK-8378417 | client-libs/2d | Printing All pages results in NPE for 1.1 PrintJob |
| 4 | JDK-8375057 | client-libs/2d | Update HarfBuzz to 12.3.2 |
| 5 | JDK-8297191 | client-libs/2d | [macos] Printing a page range with starting page > 1 results in missing pages |
| 6 | JDK-8376233 | client-libs/java.awt | Clean up code in Desktop native peer |
| 7 | JDK-8379256 | client-libs/java.awt | Update GIFlib to 6.1.1 |
| 8 | JDK-8380959 | client-libs/java.awt | Update Libpng to 1.6.56 |
| 9 | JDK-8380078 | client-libs/java.awt | Update GIFlib to 6.1.2 |
| 10 | JDK-8382047 | client-libs/java.awt | Update Libpng to 1.6.57 |
| 11 | JDK-8377526 | client-libs/java.awt | Update Libpng to 1.6.55 |
| 12 | JDK-8347826 | client-libs/java.beans | Introspector shows wrong method list after 8071693 |
| 13 | JDK-8286258 | client-libs/javax.accessibility | [Accessibility,macOS,VoiceOver] VoiceOver reads the spinner value wrong and sometime partially |
| 14 | JDK-8374506 | client-libs/javax.swing | Incorrect positioning of arrow icon in parent JMenu in Windows L&F |
| 15 | JDK-8365379 | client-libs/javax.swing | SU3.applyInsets may produce wrong results |
| 16 | JDK-8377727 | client-libs/javax.swing | Ghost caret and focus appear in non‑editable text fields |
| 17 | JDK-8365625 | client-libs/javax.swing | Can't change accelerator colors in Windows L&F |
| 18 | JDK-8321514 | core-libs/java.lang | UTF16 string gets constructed incorrectly from codepoints if CompactStrings is not enabled |
| 19 | JDK-8353698 | core-libs/java.net | Output of Simple Web Server is garbled if the console's encoding is not UTF-8 |
| 20 | JDK-8376031 | core-libs/java.net | HttpsURLConnection.getServerCertificates() throws "java.lang.IllegalStateException: connection not yet open" for the HEAD method |
| 21 | JDK-8304701 | core-libs/java.net | Request with timeout aborts later in-flight request on HTTP/1.1 cxn |
| 22 | JDK-8378631 | core-libs/java.util.jar | Update Zlib Data Compression Library to Version 1.3.2 |
| 23 | JDK-8348328 | core-libs/java.util:i18n | Update IANA Language Subtag Registry to Version 2025-05-15 |
| 24 | JDK-8362428 | core-libs/java.util:i18n | Update IANA Language Subtag Registry to Version 2025-08-25 |
| 25 | JDK-8318509 | hotspot/compiler | x86 count_positives intrinsic broken for -XX:AVX3Threshold=0 |
| 26 | JDK-8324345 | hotspot/compiler | Stack overflow during C2 compilation when splitting memory phi |
| 27 | JDK-8373894 | hotspot/gc | G1: Count evacuation-failed garbage collections in gc cpu usage |
| 28 | JDK-8322142 | hotspot/jfr | JFR: Periodic tasks aren't orphaned between recordings |
| 29 | JDK-8341427 | hotspot/jfr | JFR: Adjust object sampler span handling |
| 30 | JDK-8364190 | hotspot/jfr | JFR: RemoteRecordingStream withers don't work |
| 31 | JDK-8382242 | hotspot/jfr | JFR: Metadata reconstruction invalidates ConstantMap for java.lang.String |
| 32 | JDK-8368670 | hotspot/jfr | Deadlock in JFR on event register + class load |
| 33 | JDK-8380474 | hotspot/runtime | Crash SEGV in ThreadIdTable::lazy_initialize after JDK-8323792 |
| 34 | JDK-8357086 | hotspot/runtime | os::xxx functions returning memory size should return size_t |
| 35 | JDK-8368551 | hotspot/runtime | Core dump warning may be confusing |
| 36 | JDK-8356868 | hotspot/runtime | Not all cgroup parameters are made available |
| 37 | JDK-8338883 | hotspot/runtime | Show warning when CreateCoredumpOnCrash set, but core dump will not happen |
| 38 | JDK-8323792 | hotspot/svc | ThreadSnapshot::initialize can cause assert in Thread::check_for_dangling_thread_pointer (possibility of dangling Thread pointer) |
| 39 | JDK-8357062 | security-libs/java.security | Update Public Suffix List to 823beb1 |
| 40 | JDK-8373690 | security-libs/java.security | Unexpected Keystore message using jdk.crypto.disabledAlgorithms |
| 41 | JDK-8350749 | tools/jshell | Upgrade JLine to 3.29.0 |
| 42 | JDK-8373928 | tools/launcher | 4 Dangling pointer defect groups in java.c |