URLConnection for HTTPS connection through Proxy w/ Digest Authentication gives 400 Bad Request
August 2026 Monthly Update Release Notes
Table of Contents
August 18, 2026 - Revision 0.2
Release Details
This release is the August 2026 update release for Azul Zulu Builds of OpenJDK version 26, 25, 21, 17, 11, 8, 7, and 6. This is the first monthly update release as announced in the blog post Azul Will Deliver Monthly Java Critical Security Patch Updates, Increasing Patch Velocity with Stability.
The following table describes which Azul Zulu versions are published with this release.
Azul Zulu Version (*) |
Update Type (**) |
JDK VersionThe JDK version that is used in this release of Azul Zulu. |
Based onThe previous version of Azul Zulu that was used as the basis for the current version. |
JavaFX VersionThe version of JavaFX that is included in this release of Azul Zulu. JavaFX is available in the bandles with the |
|
|---|---|---|---|---|---|
Azul Zulu Version |
JDK Version |
||||
26.32.203 (CA) |
CSPU for PSU |
26.0.2.1+1 |
26.32.14 |
26.0.2+10 |
26.0.2+102 |
25.35.204 (SA) |
CSPU for CPU |
25.0.3.0.201+1 |
25.35 |
25.0.3.0.101+1 |
25.0.3.0.101+101 |
25.36.205 (CA) |
CSPU for PSU |
25.0.4.1+1 |
25.36.16 |
25.0.4+7 |
25.0.4+100 |
21.51.204 (SA) |
CSPU for CPU |
21.0.11.0.201+1 |
21.51 |
21.0.11.0.101+1 |
23.0.7.0.101+101 |
21.52.203 (CA) |
CSPU for PSU |
21.0.12.1+1 |
21.52.16 |
21.0.12+8 |
23.0.8+100 |
17.67.204 (SA) |
CSPU for CPU |
17.0.19.0.201+1 |
17.67 |
17.0.19.0.101+1 |
22.0.9.0.101+101 |
17.68.203 (CA) |
CSPU for PSU |
17.0.20.1+1 |
17.68.18 |
17.0.20+8 |
22.0.10+100 |
11.89.204 (SA) |
CSPU for CPU |
11.0.31.0.201+1 |
11.89 |
11.0.31.0.101+1 |
19.0.15.0.101+101 |
11.90.205 (CA) |
CSPU for PSU |
11.0.32.1+1 |
11.90.20 |
11.0.32+9 |
19.0.16+100 |
8.95.0.204 (SA) |
CSPU for CPU |
8u503-b01 |
8.95 |
8u501-b01 |
8u501-b02 |
8.96.0.205 (CA) |
CSPU for PSU |
8u504-b01 |
8.96.0.20 |
8u502-b07 |
N/A |
7.87.0.204 (SA) |
CSPU for CPU |
7u513-b01 |
7.87 |
7u511-b01 |
N/A |
6.81.0.204 (SA) |
CSPU for CPU |
6b183 |
6.81 |
6b181 |
N/A |
(*) Azul provides two types of distribution packages for each Java version:
-
Subscriber Availability (SA) distributions are tested, certified, and commercially supported Azul Zulu Builds of OpenJDK. Azul ensures that the software that uses the Accessible APIs of the product doesn’t have to include specific licenses and that such a use doesn’t contaminate the code or intellectual property of such software with any license requirements. SA builds may support configurations and features that are unavailable to free users.
-
Community Availability (CA) distributions are Azul Zulu Builds of OpenJDK that are free to download and use.
|
Note
|
Both SA and CA distributions may contain Early Access builds noted with -ea- in their filename. Early Access builds may not be TCK certified.
|
(**) Update type:
-
CSPU (Critical Security Patch Update): Contains fixes to critical issues and security vulnerabilities, delivered on a monthly basis between regular quarterly update releases.
-
CSPU for CPU: Critical security patches applied to the latest quarterly CPU release.
-
CSPU for PSU: Critical security patches applied to the latest quarterly PSU release.
-
-
CPU (Critical Patch Update): Contains fixes to security vulnerabilities and critical bug fixes. Azul Zulu CPU releases are generally based on prior-cycle PSU releases, with only security fixes applied. They provide a low-risk vehicle for the potentially urgent deployment of security fixes when issues of sufficient severity arise. CPU releases are available in SA distributions.
-
PSU (Patch Set Update): Incorporates all fixes in the corresponding CPU, as well as additional non-security bug fixes. Azul Zulu PSU releases incorporate both security fixes and other changes that align the release contents with the associated OpenJDK project quarterly release. PSU releases are available in SA and CA distributions.
What’s New
Monthly Critical Security Patch Updates
This is the first monthly Critical Security Patch Update (CSPU) for Azul Zulu Builds of OpenJDK. CSPUs close the gap between quarterly releases: as soon as a fix for a critical vulnerability becomes available for OpenJDK, it’s delivered in the next monthly release window instead of waiting up to three months for the next quarterly release.
Like every quarterly update release, each CSPU comes with two sets of binaries: CPU builds, which contain only critical and security fixes, and PSU builds, which also accumulate non-security updates, aligned with OpenJDK from the previous release. If a CSPU carries security fixes that require an immediate reaction according to your company’s security policy, you typically have less time to test before deploying. That’s where the CPU binaries help: their minimal change set reduces the risk of regressions when validation time is short.
Each CSPU has its own release notes as it is not an addition to the release notes of the quarterly update release that precedes it.
How to Handle a CPSU in Your Patch Process
The following points summarize the changes:
-
Quarterly update releases continue unchanged, in January, April, July, and October, on the third Tuesday of the month.
-
A CSPU may be published in any month that has no quarterly update — that is, every month except January, April, July, and October. Like the quarterly releases, it lands on the third Tuesday of the month, following the OpenJDK release schedule.
-
Quarterly update releases remain cumulative and include every fix delivered in the preceding CSPUs.
-
A CSPU covers the same Azul Zulu versions, release configurations, package types, Linux package repositories, and container images as a quarterly update release, and is delivered under the same support SLA.
Treat a CSPU exactly as you treat a quarterly update release: pull it into dependency management, run your existing test suite, and promote it through your normal pipeline. The only change is how often you need to check.
Changes in Version Numbering
Because a CSPU belongs to the same quarter as the update release it follows, the version numbers work slightly differently from before:
-
The minor version (
YY) now advances only at a quarterly update release. A quarterly update release and the CSPUs that follow it in the same quarter therefore share the same major and minor version (XX.YY), and are told apart by the build number (BB). -
Build numbers are grouped in blocks of one hundred, identically on the CPU and the PSU line:
100-150for the quarterly update release,200-250for the first CSPU of the quarter, and300-350for the second CSPU. The remainder of each block is reserved for Bundled Patch Release (BPR) bundles. Build numbers below100are no longer used. -
For example,
25.36.206is the SA bundle of Azul Zulu 25 in this release, the first CSPU based on the July 2026 PSU release25.36.16.
For the complete versioning scheme, see Azul Zulu Versioning and Naming Conventions.
IANA Time Zone Data Version
This release of Azul Zulu comes with IANA Time Zone Database version 2026b.
Notification of Upcoming Changes
Software Bill of Materials (SBOM) File Naming
Starting from the October 2026 release, Azul changes how it names the Software Bill of Materials (SBOM) files that accompany Zulu builds.
Current file naming:
-
Azul produces one SBOM per full Zulu version
-
Each file named with the pattern:
SBOM-zulu{zulu-version}-{season}-{index}.json -
For example:
SBOM-zulu11.89-26-07-1.0.0.json
In the future:
-
Azul will produce one SBOM per platform build
-
Each file named after the bundle it describes, using the pattern:
{bundle-name}_sbom.json -
For example:
zulu11.89.16-sa-jdk-linux_x64.tar.gz_sbom.json.
This change lets every bundle carry its own SBOM, meaning that a single full Zulu version will have several SBOMs: one per platform build, instead of one shared SBOM. Bundles can share identical SBOM content or differ from each other.
This change only affects Azul customers who receive SBOM files.
Supported Platforms
This section provides information about the operating systems that are supported in this release of Azul Zulu.
Azul Zulu Builds of OpenJDK Without and With OpenJFX
Some versions of Azul Zulu are available in different packages for specific platforms, as indicated in this overview table with:
-
: Build of OpenJDK without OpenJFX. -
: Build of OpenJDK without and with OpenJFX.
|
Note
|
The list of supported configurations and platform includes, but is not limited to, the table below. Don’t hesitate to contact Support if you have issues with Azul Zulu Builds of OpenJDK on any other platform or configuration. |
Operating System |
Azul Zulu Version |
|||||||
|---|---|---|---|---|---|---|---|---|
6 |
7 |
8 |
11 |
17 |
21 |
25 |
26 |
|
Windows Server 2025 |
|
|
|
|
|
|
|
|
Windows Server 2022 |
|
|
|
|
|
|
|
|
Windows Server 2019 |
|
|
|
|
|
|
|
|
Windows Server 2016 |
|
|
|
|
|
|
|
|
Windows 11 |
|
|
|
|
|
|
|
|
Windows (ARM 64-bit) |
||||||||
Windows 11 |
n/a |
n/a |
n/a |
n/a |
|
|
|
|
Linux (x86 32/64-bit) |
||||||||
RHEL 10.x [2]Only available in PSU builds |
|
|
|
|
|
|
|
|
RHEL 9.x |
|
|
|
|
|
|
|
|
RHEL 8.x |
|
|
|
|
|
|
|
|
RHEL 7.x |
n/a |
n/a |
|
|
|
n/a |
n/a |
n/a |
Fedora 43 |
|
|
|
|
|
|
|
|
SLES 16 |
|
|
|
|
|
|
|
|
SLES 15 |
|
|
|
|
|
|
|
|
SLES 12 |
|
|
|
|
|
|
|
|
CentOS Stream |
|
|
|
|
|
|
|
|
Ubuntu 26.04 |
|
|
|
|
|
|
|
|
Ubuntu 24.04 |
|
|
|
|
|
|
|
|
Ubuntu 22.04 |
|
|
|
|
|
|
|
|
Ubuntu 20.04 |
|
|
|
|
|
|
|
|
Ubuntu 18.04 |
|
|
|
|
|
|
|
|
Debian 13 |
|
|
|
|
|
|
|
|
Debian 12 |
|
|
|
|
|
|
|
|
Debian 11 |
|
|
|
|
|
|
|
|
Wind River 8.x |
n/a |
|
|
n/a |
n/a |
n/a |
n/a |
n/a |
Alpine Linux 3.11 or later [3]Alpine Linux 3.17 or later for Java 24+. |
n/a |
n/a |
|
|
|
|
|
|
Wolfi Linux |
n/a |
n/a |
n/a |
n/a |
n/a |
|
|
|
Amazon Linux 2023 |
n/a |
n/a |
|
|
|
|
|
|
Linux (ARM 64-bit) |
||||||||
Ubuntu 26.04 |
n/a |
n/a |
|
|
|
|
|
|
Ubuntu 24.04 |
n/a |
n/a |
|
|
|
|
|
|
Ubuntu 22.04 |
n/a |
n/a |
|
|
|
|
|
|
Ubuntu 20.04 |
n/a |
n/a |
|
|
|
|
|
|
Ubuntu 18.04 |
n/a |
n/a |
|
|
|
|
|
|
Debian 13 |
n/a |
n/a |
|
|
|
|
|
|
Debian 12 |
n/a |
n/a |
|
|
|
|
|
|
Debian 11 |
n/a |
n/a |
|
|
|
|
|
|
Alpine Linux 3.11 or later [3]Alpine Linux 3.17 or later for Java 24+. |
n/a |
n/a |
|
|
|
|
|
|
Wolfi Linux |
n/a |
n/a |
n/a |
n/a |
n/a |
|
|
|
Amazon Linux 2023 |
n/a |
n/a |
|
|
|
|
|
|
Linux with kernel 3.10.x and glibc 2.23
[4]Bundles with the Checkpoint/Restore (with the |
n/a |
n/a |
|
|
n/a |
n/a |
n/a |
n/a |
Linux (ARM 32-bit Hard-Float) |
||||||||
Ubuntu 18.04 [6]Bundles with the C1 compiler were tested on ARMv6/ARMv7/ARMv8 hardware. Bundles with both C1 and C2 compilers were tested on ARMv7/ARMv8 hardware. |
n/a |
n/a |
|
|
|
|
|
n/a |
Raspberry Pi OS 10 (Buster) [6]Bundles with the C1 compiler were tested on ARMv6/ARMv7/ARMv8 hardware. Bundles with both C1 and C2 compilers were tested on ARMv7/ARMv8 hardware. |
n/a |
n/a |
|
|
|
|
|
n/a |
Raspberry Pi OS 9 (Stretch) [6]Bundles with the C1 compiler were tested on ARMv6/ARMv7/ARMv8 hardware. Bundles with both C1 and C2 compilers were tested on ARMv7/ARMv8 hardware. |
n/a |
n/a |
|
|
n/a |
|
|
n/a |
Linux with kernel 3.10.x and glibc 2.9
[6]Bundles with the C1 compiler were tested on ARMv6/ARMv7/ARMv8 hardware. Bundles with both C1 and C2 compilers were tested on ARMv7/ARMv8 hardware.
[9]Bundles with the CRaM (with the |
n/a |
n/a |
|
|
n/a |
|
|
n/a |
Linux (ARM 32-bit Soft-Float) [10]Bundles with the C1 compiler use FPU, if it is present and available, to speed up floating point operations. Bundles with both C1 and C2 compilers require FPU. |
||||||||
Linux with kernel 2.6.34 and glibc 2.5 [11]Bundles with the C1 compiler. Tested on ARMv5 hardware. |
n/a |
n/a |
|
|
n/a |
n/a |
n/a |
n/a |
Debian 7 Wheezy [12]Bundles with the C1 compiler were tested on ARMv6 and ARMv7 hardware. Bundles with both C1 and C2 compilers were tested on ARMv7 hardware. |
n/a |
n/a |
|
|
n/a |
n/a |
n/a |
n/a |
Linux with kernel 3.10.x and glibc 2.9 [12]Bundles with the C1 compiler were tested on ARMv6 and ARMv7 hardware. Bundles with both C1 and C2 compilers were tested on ARMv7 hardware. |
n/a |
n/a |
|
|
n/a |
n/a |
n/a |
n/a |
Linux (MIPS 32-bit) [13]MIPS32r2 ISA, Big Endian, FPU in 32-bit mode or equivalent emulation. |
||||||||
Linux with kernel 4.9.59 and glibc 2.9 [14]Linux soft-float O32 MIPS ABI. |
n/a |
n/a |
|
n/a |
n/a |
n/a |
n/a |
n/a |
Linux (ppc64 Big Endian) |
||||||||
Linux with kernel 3.8.13 and glibc 2.22 [15]Bundles for this platform were tested on QorIQ® T4240-RDB. |
n/a |
n/a |
|
n/a |
n/a |
n/a |
n/a |
n/a |
Linux (ppc32 Hard-float and SPE) |
||||||||
Linux with kernel 3.12.37 and glibc 2.20 [16]Hard-Float EABI bundles were tested on QorIQ® T1024RDB. SPE ABI bundles were tested on NXP® P2020RDB. |
n/a |
n/a |
|
n/a |
n/a |
n/a |
n/a |
n/a |
QNX |
||||||||
QNX 7.0 ARMv7 32-bit Hard-Float ABI |
n/a |
n/a |
|
n/a |
n/a |
n/a |
n/a |
n/a |
QNX 7.1 ARMv8 32-bit Hard-Float ABI |
n/a |
n/a |
|
n/a |
n/a |
n/a |
n/a |
n/a |
macOS 14+ |
n/a |
|
|
|
|
|
|
|
macOS (Apple Silicon) |
||||||||
macOS 14+ |
n/a |
n/a |
|
|
|
|
|
|
Solaris (x86 and Sparc) |
||||||||
Solaris 11 |
n/a |
|
|
|
n/a |
n/a |
n/a |
n/a |
Solaris 10 |
n/a |
|
|
n/a |
n/a |
n/a |
n/a |
n/a |
Azul Zulu Builds of OpenJDK With CRaC
|
Note
|
Currently, CRaC is only available for the specified Linux systems, in the versions listed below of Azul Zulu Builds of OpenJDK. For development, you can use the CRaC Java library on any platform and simulate the CRaC functionality. |
-
: Build of OpenJDK with full CRaC support and the Warp engine.
-
: Build of OpenJDK with CRaC support for development purposes. These provide a simulated checkpoint/restore mechanism to be used for development and testing.
Operating System |
Azul Zulu Versions |
|
|---|---|---|
17, 21, 25, 26 |
||
x86 64-bit |
ARM 64-bit |
|
Linux |
|
|
Alpine Linux 3.16 |
|
|
Windows |
|
n/a |
macOS |
|
|
Fixed Issues
This section covers all issues that were fixed in this release.
Fixed Common Vulnerabilities and Exposures
|
Note
|
The full CVE list will be available in V1.0 of this release notes document. |
Non-CVE Security Fixes
|
Note
|
The full Non-CVE Security Fixes list will be available in V1.0 of this release notes document. |
OpenJDK Fixes and Enhancements
The following table describes the OpenJDK changes implemented in this release.
| OpenJDK Patch ID | Azul Zulu Version | Synopsis | CPU/PSUCPU fixes are included in both CPU and PSU bundles. PSU fixes are included in the PSU bundles only. |
|---|---|---|---|
6 |
CPU,PSU |
||
6,7,8,11,17,21,25,26 |
Improve Resource Resolving |
CPU,PSU |
|
6,7,8,11,17,21,25,26 |
Enhance HTTP Connections |
CPU,PSU |
|
8,11,17,21,25,26 |
Enhance TLS server |
CPU,PSU |
|
25,26 |
Improve font loading |
CPU,PSU |
|
8,11 |
Update FreeType to 2.14.3 |
PSU |
|
11 |
[11u] Remove designator DEFAULT_PROMOTED_VERSION_PRE=ea for release 11.0.32 |
PSU |
|
25 |
Bump update version for OpenJDK: jdk-25.0.4.1 |
PSU |
|
8 |
[8u] VS2010 build broken by JDK-8374058 |
PSU |
|
11 |
Bump update version for OpenJDK: jdk-11.0.32.1 |
PSU |
|
8 |
Bump update version for OpenJDK: 8u504 |
PSU |
|
25 |
[25u] Remove designator DEFAULT_PROMOTED_VERSION_PRE=ea for release 25.0.4.1 |
PSU |
OpenJFX Fixes and Enhancements
The following table describes the JavaFX changes implemented in this release.
| OpenJDK Patch ID | Azul Zulu Version | Synopsis | CPU/PSUCPU fixes are included in both CPU and PSU bundles. PSU fixes are included in the PSU bundles only. |
|---|---|---|---|
No issues fixed in this release |
|||
Fixes and Enhancements Specific to Azul Zulu Builds of OpenJDK
The following table describes the Azul Zulu changes implemented in this release.
| Issue ID | Azul Zulu Version | Synopsis | CPU/PSUCPU fixes are included in both CPU and PSU bundles. PSU fixes are included in the PSU bundles only. |
|---|---|---|---|
ZULU-91815 |
25 |
Bundle PQ-JSSE with Zulu 25 |
PSU |
ZULU-94523 |
25 |
Update PQJSSE for the August release |
PSU |
Fixes and Enhancements Specific to Azul Zulu Builds of OpenJDK With JavaFX
The following table describes the Azul Zulu changes implemented in this release.
| Issue ID | Azul Zulu Version | Synopsis | CPU/PSUCPU fixes are included in both CPU and PSU bundles. PSU fixes are included in the PSU bundles only. |
|---|---|---|---|
No issues fixed in this release |
|||