Release notes for Red Hat build of OpenJDK 25.0.1


Red Hat build of OpenJDK 25

Red Hat Customer Content Services

Abstract

The Release notes for Red Hat build of OpenJDK 25.0.1 document provides an overview of new features in Red Hat build of OpenJDK 25 and a list of potential known issues and possible workarounds.

Preface

Open Java Development Kit (OpenJDK) is a free and open source implementation of the Java Platform, Standard Edition (Java SE). The Red Hat build of OpenJDK is available in five versions: 8u, 11u, 17u, 21u, and 25u.

Packages for the Red Hat build of OpenJDK 25 are made available on Red Hat Enterprise Linux and shipped as a JDK and JRE in the Red Hat Ecosystem Catalog.

Note

Red Hat does not provide a release of Red Hat build of OpenJDK 25 for Microsoft Windows or Windows Server.

To report an error or to improve our documentation, log in to your Red Hat Jira account and submit an issue. If you do not have a Red Hat Jira account, then you will be prompted to create an account.

Procedure

  1. Click the following link to create a ticket.
  2. Enter a brief description of the issue in the Summary.
  3. Provide a detailed description of the issue or enhancement in the Description. Include a URL to where the issue occurs in the documentation.
  4. Clicking Create creates and routes the issue to the appropriate documentation team.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. We are beginning with these four terms: master, slave, blacklist, and whitelist. Because of the enormity of this endeavor, these changes will be implemented gradually over several upcoming releases. For more details, see our CTO Chris Wright’s message.

Red Hat will support select major versions of Red Hat build of OpenJDK in its products. For consistency, these versions match the Oracle JDK versions that are designated as long-term support (LTS).

For more information about Red Hat’s support policy for Red Hat build of OpenJDK, see the OpenJDK Life Cycle and Support Policy.

For more information about the supported operating systems for each available version of Red Hat build of OpenJDK, see the OpenJDK on RHEL Support Table and OpenJDK on Windows Support Table.

Important

Red Hat does not provide a release of Red Hat build of OpenJDK 25 for Windows platforms. For convenience, Red Hat redistributes the Eclipse Temurin 25 builds for Windows, which are the same binaries distributed by the Eclipse Adoptium project. If you want to install Eclipse Temurin 25 for Windows, you can download these binaries from either the Red Hat Customer Portal or the Eclipse Adoptium web site. For more information about Red Hat’s support policy for Red Hat build of OpenJDK, see the OpenJDK Life Cycle and Support Policy. For more information about Red Hat’s support policy for Eclipse Temurin, see Red Hat support for Eclipse Temurin.

Chapter 2. Differences from upstream OpenJDK 25

Red Hat build of OpenJDK on Red Hat Enterprise Linux contains a number of structural changes from the upstream distribution of OpenJDK. Red Hat does not provide a Windows version of Red Hat build of OpenJDK 25. For convenience, Red Hat redistributes the Eclipse Temurin 25 builds for Windows, which are the same binaries distributed by the Eclipse Adoptium project.

The following list details the most notable Red Hat build of OpenJDK 25 changes:

  • FIPS support. Red Hat build of OpenJDK 25 automatically detects whether RHEL is in FIPS mode and automatically configures Red Hat build of OpenJDK 25 to operate in that mode.
  • Cryptographic policy support. Red Hat build of OpenJDK 25 obtains the list of enabled cryptographic algorithms and key size constraints from the RHEL system configuration. These configuration components are used by the Transport Layer Security (TLS) encryption protocol, the certificate path validation, and any signed JARs. You can set different security profiles to balance safety and compatibility.
  • The src.zip file includes the source for all of the JAR libraries shipped with Red Hat build of OpenJDK.
  • Red Hat build of OpenJDK on RHEL uses system-wide timezone data files as a source for timezone information.
  • Red Hat build of OpenJDK on RHEL uses system-wide CA certificates.

The following cryptographic policies setup automatically detects when the system is in FIPS mode and configures Red Hat build of OpenJDK 25 accordingly. If Red Hat build of OpenJDK 25 needs to ignore the system and disable its FIPS setup, you can disable use of the system cryptographic policies in any of the following ways:

On a per-run basis

The redhat.crypto-policies system property is a boolean switch that controls use of cryptographic policies on a per-run basis. If you want to disable the system cryptographic policies for a specific run, pass the ‑Dredhat.crypto-policies=false option.

This setup consists of the following files in the $JAVA_HOME/conf/security directory:

  • redhat/false/crypto-policies.properties

    This is the policies usage disabled file. It is an empty file that is applied when redhat.crypto-policies is set to false.

  • redhat/true/crypto-policies.properties

    This is the policies usage enabled file. It is used to perform the cryptographic policies and FIPS setup, and it is applied when redhat.crypto-policies is set to true.

  • redhat/crypto-policies.properties

    This is the policies usage default file. It determines the default choice by including one of the preceding files (for example, include true/crypto-policies.properties). This file is applied when the ‑Dredhat.crypto-policies option is not passed. The use of system cryptographic policies is enabled by default.

On a per-deployment basis

To enable or disable cryptographic policies on a per-deployment basis, edit the policies usage default file, redhat/crypto-policies.properties, to change the specified include file, as appropriate.

For example, to persistently disable cryptographic policies, run the following command:

sed -i s/true/false/ $JAVA_HOME/conf/security/redhat/crypto-policies.properties
Note

Applications can still override this on a per-run basis, for example, by passing the ‑Dredhat.crypto-policies=true option.

At the java.security file level (overriding the per-run and per-deployment settings)

To force-disable or force-apply system cryptographic policies, modify the following include directive in the java.security file, as appropriate:

include redhat/${redhat.crypto-policies}/crypto-policies.properties

For example:

  • To force-disable system cryptographic policies, remove or comment out this directive as follows:

    #include redhat/${redhat.crypto-policies}/crypto-policies.properties
  • Alternatively, to force-apply system cryptographic policies, modify this directive as follows:

    include redhat/true/crypto-policies.properties
Note

If you specify anything after this include directive, it will be applied on top of the described setup. Avoid adding any properties below this section, because it might override the system cryptographic policies or invalidate the FIPS deployment.

Red Hat build of OpenJDK 25 includes a number of enhancements that are not available in Red Hat build of OpenJDK 21, which is the previous long-term support (LTS) release.

For more information about the additional Java enhancement proposals (JEPs) that Red Hat build of OpenJDK 25 includes, see JEPs in JDK 25 integrated since JDK 21.

Ensure that you review the following deprecated and unsupported features before you install Red Hat build of OpenJDK 25:

Removed support for Red Hat build of OpenJDK 25 on Windows platforms

From the initial OpenJDK 25 release onward, Red Hat does not support or provide a distribution of Red Hat build of OpenJDK 25 for Microsoft Windows and Windows Server platforms.

If you want to use OpenJDK 25 on Windows, consider using Eclipse Temurin 25 from the Eclipse Adoptium working group. For more information about Red Hat’s support policy for Eclipse Temurin, see Red Hat support for Eclipse Temurin.

Note

Red Hat continues to support and provide regular updates for older versions of Red Hat build of OpenJDK on Microsoft Windows and Windows Server. For more information, see OpenJDK on Windows Support Table.

Removed non-generational mode of Z garbage collector

Red Hat build of OpenJDK 25 removes the non-generational mode of the Z garbage collector (ZGC). In this release, ZGC uses the generational mode by default.

For more information see the following JEPs:

Removed string templates preview feature

String templates were a preview feature that was introduced in OpenJDK 21 (JEP 430) with a second preview in OpenJDK 22 (JEP 459). A third preview was proposed for OpenJDK 23 (JEP 465), but it was subsequently withdrawn and the feature is no longer available.

For more information about the withdrawal of string templates, see https://mail.openjdk.org/pipermail/amber-spec-experts/2024-April/004106.html.

Memory-access methods in sun.misc.Unsafe are deprecated

Red Hat build of OpenJDK 25 deprecates the memory-access methods in the sun.misc.Unsafe class for removal in a future release. These unsupported methods are superseded by standard APIs, such as the VarHandle API (JEP 193) and the Foreign Function and Memory (FFM) API (JEP 454). Library developers should consider migrating from sun.misc.Unsafe to supported replacements, so that applications can migrate smoothly to modern JDK releases.

Note

Red Hat build of OpenJDK 25 issues a runtime warning the first time that any memory-access method in sun.misc.Unsafe is invoked.

For more information, see the following JEPs:

Security Manager is permanently disabled

The Security Manager has not been used as the primary way to secure client-side Java code for many years, it has rarely been used to secure server-side code, and it is costly to maintain. The Security Manager was therefore deprecated in Red Hat build of OpenJDK 17 based on JEP 411 for removal in a future release.

In Red Hat build of OpenJDK 25, as a further step towards removal of the Security Manager, the Java Platform specification permanently disables it. This means that developers can no longer enable the Security Manager. In addition, other Java platform classes do not refer to it. This change does not impact the vast majority of applications, libraries, and tools.

The Security Manager API is planned for removal in a future release.

For more information, see JEP 486: Permanently Disable the Security Manager.

The initial release of Red Hat build of OpenJDK 25 includes new features that enhance the use of your Java applications.

Red Hat build of OpenJDK 25 includes the following new features.

6.1. Language features

Red Hat build of OpenJDK 25 includes the following new language features.

Flexible constructor bodies

In Java constructors, Red Hat build of OpenJDK 25 allows statements to appear before the explicit constructor invocations, super(…​) and this(…​). These statements cannot reference the instance that is under construction, but they can initialize its fields. This ability to initialize fields before invoking another constructor makes a class more reliable when methods are overridden.

For example, in earlier releases, you could only call a statement after the constructor invocation as follows:

 void myMethod(int a, int b) {
    super(b);
    this.a = a;
  }

In this release, you can call the statement before the constructor invocation. Based on the following example, it means that a is set when the super constructor and any methods that it calls are running:

  void myMethod(int a, int b) {
    this.a = a;
    super(b);
  }

This feature was initially introduced as a preview feature named Statements before super(…​) in OpenJDK 22 (JEP 447). A second preview was introduced in OpenJDK 23 (JEP 482) with support for allowing fields to be initialized before invoking another constructor. A third preview was introduced in OpenJDK 24 (JEP 492).

For more information, see the following JEPs:

Unnamed patterns and variables

In Red Hat build of OpenJDK 25, Java includes support for unnamed patterns, which match a record component without stating the component’s name or type. In this release, Java also now supports unnamed variables, which can be initialized but not used. Unnamed patterns and unnamed variables are both denoted by an underscore (_) character.

This feature was initially introduced as a preview feature in OpenJDK 21 (JEP 443), and it was finalized in OpenJDK 22 (JEP 456).

For more information, see the following JEPs:

Primitive types in patterns, instanceof, and switch (Preview)

Red Hat build of OpenJDK 25 adds a preview feature to enhance pattern matching by allowing primitive type patterns in all pattern contexts. This preview feature also extends the instanceof operator and switch statement to work with all primitive types.

For more information, see the following JEPs:

Module import declarations

In Red Hat build of OpenJDK 25, Java includes support for succinctly importing all of the packages that are exported by a module. This enhancement simplifies the reuse of modular libraries, but it does not require the code that is performing the import to be in a module itself.

This feature was initially introduced as a preview feature in OpenJDK 23 (JEP 476) with a second preview in OpenJDK 24 (JEP 494).

For more information, see the following JEPs:

6.2. Library features

Red Hat build of OpenJDK 25 includes the following new library features.

Foreign function and memory API

Red Hat build of OpenJDK 25 includes a Foreign function and memory (FFM) API that Java programs can use to interoperate with code and data outside of the Java runtime. A foreign function is code outside the Java virtual machine (JVM), and foreign memory is memory that is not managed by the JVM. By efficiently invoking foreign functions and by safely accessing foreign memory, this API allows Java programs to call native libraries and process native data without having to rely on the Java Native Interface (JNI).

This feature was initially introduced in incubation in OpenJDK 17 (JEP 412) as an evolution of the Foreign Memory Access API and Foreign Linker API. It had a second round of incubation in OpenJDK 18 (JEP 419), and it was then introduced as a preview feature in OpenJDK 19 (JEP 424), with a second and third preview in OpenJDK 20 (JEP 434) and OpenJDK 21 (JEP 442), respectively. It was finalized in OpenJDK 22 (JEP 454).

For more information, see the following JEPs:

Warning about JNI usage and consistent warnings from FFM API

Red Hat build of OpenJDK 25 issues warnings about use of the Java Native Interface (JNI). This release also ensures that the Foreign Function & Memory (FFM) API issues warnings in a consistent manner. These warnings aim to prepare developers for a future release that uniformly restricts JNI and the FFM API to ensure integrity by default. Application developers can avoid both current warnings and future restrictions by selectively enabling these interfaces, if necessary, by using the ‑‑enable‑native‑access command-line option.

For more information, see JEP 472: Prepare to Restrict the Use of JNI.

ClassFile API

Red Hat build of OpenJDK 25 includes a ClassFile API, which is a standard API for parsing, generating, and transforming Java class files.

This API was introduced as a preview feature in OpenJDK 22 (JEP 457) with a second preview in OpenJDK 23 (JEP 466). It was finalized in OpenJDK 24 (JEP 484).

For more information, see the following JEPs:

Vector API (Incubator feature)

Red Hat build of OpenJDK 25 includes a Vector API, which is used to express vector computations that reliably compile at runtime to optimal vector hardware instructions on supported CPU architectures. These optimal instructions achieve performance levels that are superior to equivalent scalar computations.

This API is an incubation feature that was initially introduced in OpenJDK 16, and which has subsequently had nine additional rounds of incubation up to OpenJDK 25.

For more information, see the following JEPs:

Stream gatherers

Red Hat build of OpenJDK 25 includes an enhancement to the Stream API to support custom intermediate operations. This enhancement allows stream pipelines to transform data in ways that are not easily achieved with the existing built-in intermediate operations.

This enhancement was introduced as a preview feature in OpenJDK 22 (JEP 461) with a second preview in OpenJDK 23 (JEP 473). It was finalized in OpenJDK 24 (JEP 485).

For more information, see the following JEPs:

Structured concurrency (Preview)

Red Hat build of OpenJDK 25 adds an API for structured concurrency as a preview feature to help simplify multithreaded programming. Structured concurrency treats multiple tasks that are running in different threads as a single unit of work, which helps to streamline error handling and cancellation, improve reliability, and enhance observability.

This API was initially introduced in incubation in OpenJDK 19 (JEP 428) with a second round of incubation in OpenJDK 20 (JEP 437). It then became a preview feature in OpenJDK 21 (JEP 453) with an additional four preview rounds up to OpenJDK 25.

For more information, see the following JEPs:

Compact source files and instance main methods

In Red Hat build of OpenJDK 25, beginners in the Java programming language can write their first programs without needing to understand language features that are designed for large programs. Instead of using a separate dialect of Java, beginners can write streamlined declarations for single-class programs and seamlessly expand their programs to use more advanced features as their skills grow. Experienced developers can similarly write small programs succinctly, without the need for constructs intended for large-scale programming.

This feature was initially introduced as a preview feature named Unnamed Classes and Instance Main Methods in OpenJDK 21 (JEP 445). Due to the move away from unnamed classes to an implicitly declared name chosen by the host system, it had a second preview that was renamed Implicitly Declared Classes and Instance Main Methods in OpenJDK 22 (JEP 463). It had a third preview in OpenJDK 23 (JEP 477). A fourth preview that was renamed Simple Source Files and Instance Main Methods was introduced in OpenJDK 24 (JEP 495) with new terminology but no additional changes.

For more information, see the following JEPs:

Scoped values

Red Hat build of OpenJDK 25 includes a scoped values feature, which enables the sharing of immutable data within and across threads. Scoped values are preferable to thread-local variables, especially when using large numbers of virtual threads.

This feature was initially introduced in incubation in OpenJDK 20 (JEP 429). It became a preview feature in OpenJDK 21 (JEP 446) with an additional three preview rounds in OpenJDK 22 (JEP 464), OpenJDK 23 (JEP 481), and OpenJDK 24 (JEP 487).

For more information, see the following JEPs:

Key derivation function API

Red Hat build of OpenJDK 25 includes an API for Key Derivation Functions (KDFs). KDFs are cryptographic algorithms for deriving additional keys from a secret key and other data.

This API was initially introduced as a preview feature in OpenJDK 24 (JEP 478).

For more information, see the following JEPs:

Quantum-resistant module-lattice-based key encapsulation mechanism

Red Hat build of OpenJDK 25 includes an implementation of the quantum-resistant Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM), which helps to enhance the security of Java applications. Key encapsulation mechanisms (KEMs) are used to secure symmetric keys over insecure communication channels by using public key cryptography. ML-KEM is designed to be secure against future quantum computing attacks. It has been standardized by the United States National Institute of Standards and Technology (NIST) in FIPS 203.

For more information, see JEP 496: Quantum-Resistant Module-Lattice-Based Key Encapsulation Mechanism.

Quantum-resistant module-lattice-based digital signature algorithm

Red Hat build of OpenJDK 25 includes an implementation of the quantum-resistant Module-Lattice-Based Digital Signature Algorithm (ML-DSA), which helps to enhance the security of Java applications. Digital signatures are used to detect unauthorized modifications to data and to authenticate the identity of signatories. ML-DSA is designed to be secure against future quantum computing attacks. It has been standardized by the United States NIST in FIPS 204.

For more information, see JEP 497: Quantum-Resistant Module-Lattice-Based Digital Signature Algorithm.

PEM encodings of cryptographic objects (Preview)

Red Hat build of OpenJDK 25 adds an API for Privacy-Enhanced Mail (PEM) encodings of cryptographic objects as a preview feature. This API is used for encoding objects that represent cryptographic keys, certificates, and certificate revocation lists into the PEM transport format. It is also used for decoding from that format back into objects.

For more information, see JEP 470: PEM Encodings of Cryptographic Objects (Preview).

Stable values (Preview)

Red Hat build of OpenJDK 25 adds an API for stable values as a preview feature. Stable values are objects that hold immutable data. The JVM treats these values as constants, enabling the same performance optimizations that are enabled by declaring a field with the final keyword. However, due to the timing of their initialization, stable values offer greater flexibility compared to final fields.

For more information, see JEP 502: Stable Values (Preview).

6.3. Virtual machine enhancements

Red Hat build of OpenJDK 25 includes the following virtual machine enhancements.

Region pinning for G1 garbage collector

Red Hat build of OpenJDK 25 includes region pinning in the G1 garbage collector to help reduce latency. This enhancement means that garbage collection does not need to be disabled during JNI critical regions.

For more information see, JEP 423: Region Pinning for G1.

ZGC uses generational mode by default

In Red Hat build of OpenJDK 25, the Z garbage collector (ZGC) uses generational mode by default. This supersedes the behavior in earlier releases where ZGC used the now removed non-generational mode by default.

For more information, see the following JEPs:

Late barrier expansion for G1 garbage collector

Red Hat build of OpenJDK 25 simplifies the implementation of the G1 garbage collector’s barriers, which record information about application memory accesses. This release shifts the expansion of these barriers from early in the C2 just-in-time (JIT) compilation pipeline to later.

For more information, see JEP 475: Late Barrier Expansion for G1.

Ahead-of-time class loading and linking

Red Hat build of OpenJDK 25 improves the startup time for applications by making an application’s classes instantly available in a loaded and linked state when the HotSpot JVM starts. In this situation, an application is monitored during one run, and the loaded and linked forms of all of the application’s classes are then stored in a cache for use in subsequent runs. This feature also provides a foundation for future improvements in startup and warm-up times.

The use of this feature involves a two-step process:

  1. Create the Ahead-of-Time cache from a training run of the application by using the ‑‑XX:AOTCacheOutput=<cache name> option, where <cache name> is the cache reference to use in later runs.
  2. When subsequently running the application in a test or production environment, use the ‑XX:AOTCache=<cache name> option to run the application with the cache you generated previously.

As shown in the preceding steps, you can use the ‑‑XX:AOTCacheOutput option to handle both the training run and creation of the cache in a single step by using a temporary configuration file. In this situation, you can use the JDK_AOT_VM_OPTIONS environment variable to pass options for cache creation without affecting the training run.

Note

In the initial implementation of this feature in OpenJDK 24, the training run and cache creation tasks needed to be handled in separate steps. Red Hat build of OpenJDK 25 adds the ‑‑XX:AOTCacheOutput option to help streamline these tasks into a single command.

For more information, see the following JEPs:

Ahead-of-time class method profiling

Red Hat build of OpenJDK 25 improves the warm-up time for applications by making method-execution profiles from a previous run of an application instantly available when the HotSpot JVM starts. This feature allows the JIT compiler to generate native code immediately at application startup instead of having to wait for profiles to be collected.

For more information, see JEP 515: Ahead-of-Time Method Profiling.

Synchronize virtual threads without pinning

Red Hat build of OpenJDK 25 improves the scalability of Java code that uses synchronized methods and statements. The JDK now arranges for virtual threads that block in such constructs to release their underlying platform threads for use by other virtual threads. This feature eliminates almost all cases of virtual threads being pinned to platform threads, which might otherwise severely restrict the number of available virtual threads for handling an application’s workload.

For more information, see JEP 491: Synchronize Virtual Threads without Pinning.

Compact object headers

Red Hat build of OpenJDK 25 can optionally reduce the size of object headers in the HotSpot JVM from between 96 and 128 bits down to 64 bits on 64-bit architectures. This feature helps to reduce heap size, improve deployment density, and increase data locality. You can enable this feature by using the ‑XX:+UseCompactObjectHeaders option.

This change was initially introduced as an experimental feature in OpenJDK 24 (JEP 450) that also required the ‑XX:+UnlockExperimentalVMOptions option.

For more information, see the following JEPs:

Generational Shenandoah garbage collection

Red Hat build of OpenJDK 25 enhances the Shenandoah garbage collector with generational collection support that helps to improve sustainable throughput, load-spike resilience, and memory utilization. You can enable this feature by using the ‑XX:ShenandoahGCMode=generational option.

This change was initially introduced as an experimental feature in OpenJDK 24 (JEP 404) that also required the ‑XX:+UnlockExperimentalVMOptions option.

For more information, see the following JEPs:

JFR cooperative sampling

Red Hat build of OpenJDK 25 improves the stability of the JDK Flight Recorder (JFR) when it asynchronously samples Java thread stacks. This is achieved by walking call stacks at safepoints only, while minimizing safepoint bias.

For more information, see JEP 518: JFR Cooperative Sampling.

JFR method timing and tracing

Red Hat build of OpenJDK 25 extends the JFR with support for method timing and tracing through bytecode instrumentation.

For more information, see JEP 520: JFR Method Timing & Tracing.

JFR CPU-time profiling (Experimental)

Red Hat build of OpenJDK 25 adds an experimental feature to allow the JFR to capture more accurate CPU-time profiling information on Linux platforms. Because this is an experimental feature, the associated JFR events are tagged with @Experimental annotation.

Unlike other experimental virtual machine features, you do not need to explicitly enable this feature by using the XX:+UnlockExperimentalVMOptions option.

For more information, see JEP 509: JFR CPU-Time Profiling (Experimental).

6.4. Tooling enhancements

Red Hat build of OpenJDK 25 includes the following tooling enhancements.

Application launcher support for multi-file source code programs

In Red Hat build of OpenJDK 25, the java application launcher is able to run a program that is supplied as multiple Java source code files. This helps to make the transition from small programs to larger programs more gradual, which gives developers flexibility in deciding whether and when to configure a build tool.

For more information, see JEP 458: Launch Multi-File Source-Code Programs.

Javadoc support for markdown documentation comments

In Red Hat build of OpenJDK 25, Javadoc authors can write documentation comments in markdown language rather than solely in a mixture of HTML and JavaDoc @<metadata> tags.

For more information, see JEP 467: Markdown Documentation Comments.

Red Hat build of OpenJDK 25.0.1 includes the following bug fixes and deprecations.

7.1. Red Hat build of OpenJDK bug fixes

Red Hat build of OpenJDK 25 includes the following bug fix.

Fix for issue caused by changing type of java.time month and day fields to byte

In the initial release of Red Hat build of OpenJDK 25, when attempting to read serialized Class objects that were created in earlier OpenJDK versions for some of the java.time classes, a failure occurred with an InvalidClassException. Similarly, java.time Class objects that were serialized with Red Hat build of OpenJDK 25 could not be read by older OpenJDK versions.

This issue was introduced in the initial release of Red Hat build of OpenJDK 25, which changed the month and day fields in java.time classes to the byte type.

Note

This incompatibility occurred specifically with the Class object rather than instances of the object. For example, writeObject(LocalDate.class) methods produced incompatible serialized data, but writeObject(LocalDate.now()) methods did not produce this incompatibility.

Red Hat build of OpenJDK 25.0.2 resolves this issue by reverting to the earlier behavior that was available before the introduction of Red Hat build of OpenJDK 25. This fix also helps to restore compatibility between Red Hat build of OpenJDK 25 and older versions.

See JDK-8367031 (JDK Bug System).

7.2. Red Hat build of OpenJDK deprecated features

The following pre-existing feature has been removed in Red Hat build of OpenJDK 25.0.1.

AffirmTrust root CA certificates removed

From Red Hat build of OpenJDK 25.0.1 onward, the cacerts truststore no longer includes the following AffirmTrust root certificates:

Certificate 1
  • Alias name: affirmtrustcommercialca [jdk]
  • Distinguished name: CN=AffirmTrust Commercial, O=AffirmTrust, C=US
  • SHA256: 03:76:AB:1D:54:C5:F9:80:3C:E4:B2:E2:01:A0:EE:7E:EF:7B:57:B6:36:E8:A9:3C:9B:8D:48:60:C9:6F:5F:A7
Certificate 2
  • Alias name: affirmtrustnetworkingca [jdk]
  • Distinguished name: CN=AffirmTrust Networking, O=AffirmTrust, C=US
  • SHA256: 0A:81:EC:5A:92:97:77:F1:45:90:4A:F3:8D:5D:50:9F:66:B5:E2:C5:8F:CD:B5:31:05:8B:0E:17:F3:F0B4:1B
Certificate 3
  • Alias name: affirmtrustpremiumca [jdk]
  • Distinguished name: CN=AffirmTrust Premium, O=AffirmTrust, C=US
  • SHA256: 70:A7:3F:7F:37:6B:60:07:42:48:90:45:34:B1:14:82:D5:BF:0E:69:8E:CC:49:8D:F5:25:77:EB:F2:E9:3B:9A
Certificate 4
  • Alias name: affirmtrustpremiumeccca [jdk]
  • Distinguished name: CN=AffirmTrust Premium ECC, O=AffirmTrust, C=US
  • SHA256: BD:71:FD:F6:DA:97:E4:CF:62:D1:64:7A:DD:25:81:B0:7D:79:AD:F8:39:7E:B4:EC:BA:9C:5E:84:88:82:14:23

See JDK-8361212 (JDK Bug System).

Chapter 8. Advisories related to this release

The following advisories are issued to document bug fixes and CVE fixes included in this release:

Revised on 2026-04-10 11:18:57 UTC

Legal Notice

Copyright © Red Hat.
Except as otherwise noted below, the text of and illustrations in this documentation are licensed by Red Hat under the Creative Commons Attribution–Share Alike 3.0 Unported license . If you distribute this document or an adaptation of it, you must provide the URL for the original version.
Red Hat, as the licensor of this document, waives the right to enforce, and agrees not to assert, Section 4d of CC-BY-SA to the fullest extent permitted by applicable law.
Red Hat, the Red Hat logo, JBoss, Hibernate, and RHCE are trademarks or registered trademarks of Red Hat, LLC. or its subsidiaries in the United States and other countries.
Linux® is the registered trademark of Linus Torvalds in the United States and other countries.
XFS is a trademark or registered trademark of Hewlett Packard Enterprise Development LP or its subsidiaries in the United States and other countries.
The OpenStack® Word Mark and OpenStack logo are trademarks or registered trademarks of the Linux Foundation, used under license.
All other trademarks are the property of their respective owners.
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2026 Red Hat
Back to top