CA Enhancements
Out-of-Cycle October 21, 2026 Quarterly Update Release
October 21, 2026 - Revision 1.1
Release Details
This release is an update release for the October 2026 quarterly update release for Azul Zulu Builds of OpenJDK version 27, 25, 21, 17, 11, 8, 7, and 6, related to security issues with specific CA Certificates.
|
Important
|
It’s recommended to update to this release build ASAP. Zulu runtimes that can’t be updated immediately can be fixed with a workaround for the eMudhra intermediate CA certificate compromise issue. |
The following table describes which Azul Zulu versions are published with this release.
Azul Zulu Version (*) |
Update Type (**) |
JDK VersionThe JDK version that is used in this release of Azul Zulu. |
Based onThe previous version of Azul Zulu that was used as the basis for the current version. |
JavaFX VersionThe version of JavaFX that is included in this release of Azul Zulu. JavaFX is available in the bundles with the |
|
|---|---|---|---|---|---|
Azul Zulu Version |
JDK Version |
||||
27.30.107 (CA) |
PSU |
27.0.1+9 |
27.28 |
27.0.0+35 |
27.0.1+101 |
25.37.114 (SA) |
CPU |
25.0.4.1.101+1 |
25.36 |
25.0.4.1.1+1 |
25.0.4.0.101+102 |
25.38.107 (CA) |
PSU |
25.0.5+8 |
25.37 |
25.0.4.1.101+1 |
25.0.5+100 |
21.53.112 (SA) |
CPU |
21.0.12.1.101+1 |
21.52 |
21.0.12.1+1 |
23.0.8.0.101+101 |
21.54.107 (CA) |
PSU |
21.0.13+9 |
21.53 |
21.0.12.1.101+1 |
23.0.9+102 |
17.69.112 (SA) |
CPU |
17.0.20.1.101+1 |
17.68 |
17.0.20.1+1 |
22.0.10.0.101+101 |
17.70.111 (CA) |
PSU |
17.0.21+9 |
17.69 |
17.0.20.1.101+1 |
22.0.11+103 |
11.91.112 (SA) |
CPU |
11.0.32.1.101+1 |
11.90 |
11.0.32.1+1 |
19.0.16.0.101+101 |
11.92.109 (CA) |
PSU |
11.0.33+9 |
11.91 |
11.0.32.1.101+1 |
19.0.17+102 |
8.97.0.110 (SA) |
CPU |
8u511-b01 |
8.96 |
8u504-b01 |
8u511-b03 |
8.98.0.107 (CA) |
PSU |
8u512-b08 |
8.97 |
8u511-b01 |
8u512-b02 |
7.89.0.110 (SA) |
CPU |
7u521-b01 |
7.87 |
7u513-b01 |
N/A |
6.83.0.108 (SA) |
CPU |
6b191 |
6.81 |
6b183 |
N/A |
(*) Azul provides two types of distribution packages for each Java version:
-
Subscriber Availability (SA) distributions are tested, certified, and commercially supported Azul Zulu Builds of OpenJDK. Azul ensures that the software that uses the Accessible APIs of the product doesn’t have to include specific licenses and that such a use doesn’t contaminate the code or intellectual property of such software with any license requirements. SA builds may support configurations and features that are unavailable to free users.
-
Community Availability (CA) distributions are Azul Zulu Builds of OpenJDK that are free to download and use.
|
Note
|
Both SA and CA distributions may contain Early Access builds noted with -ea- in their filename. Early Access builds may not be TCK certified.
|
(**) Update type:
-
CPU (Critical Patch Updates) contain fixes to security vulnerabilities and critical bug fixes. Azul Zulu CPU releases are generally based on prior-cycle PSU releases, with only security fixes applied. They provide a low-risk vehicle for the potentially urgent deployment of security fixes when issues of sufficient severity arise. CPU releases are available in SA distributions.
-
PSU (Patch Set Updates) incorporates all fixes in the corresponding CPU, as well as additional non-security bug fixes. Azul Zulu PSU releases incorporate both security fixes and other changes that align the release contents with the associated OpenJDK project quarterly release. PSU releases are available in SA and CA distributions.
What’s New
This update releases fixes a security issue related to the compromise of eMudhra intermediate CA certificates.
Blocked eMudhra Intermediate CA Certificates
On October 20, 2026, Mozilla publicly disclosed that the private keys of eight eMudhra intermediate CA certificates were compromised. Azul Zulu trusts the root certificates these intermediates chain to, and Java does not check certificate revocation by default. Without a fix, Zulu would accept certificates issued with the compromised keys.
This update release adds the eight compromised intermediate certificates to the list of blocked certificates (blocked.certs in JDK 11+, or blacklisted.certs in older versions) in the lib/security directory of all Azul Zulu builds listed in this document. No manual workaround is needed after upgrading to this release.
Major browsers and operating systems already block these certificates, so legitimate connections should not be affected.
Fixed Issues
This section covers all issues that were fixed in this release.