Open JDK build number for JDK 8 is displayed incorrectly in java -version output.
25.07.0.0
25.07.0.0
Release date: July 31, 2025
This CPU release is based on the Azul Zing Build of OpenJDK (Zing) 25.06.0.0 and corresponds to the following OpenJDK versions:
| Major Version | OpenJDK Version |
|---|---|
8 |
1.8.0_461-b1 |
11 |
11.0.27.0.101+1-LTS |
17 |
17.0.15.0.101+1-LTS |
21 |
21.0.7.0.101+1-LTS |
What’s New
-
Zing 25.07.0.0 changes the default values for the following command line option:
-
-XX:AvoidInterruptsDuringHeapFundinghas changed from false to true by default. This change also helps avoid intermittent failures during funding with libonload. For more information about this option, see Command Line Options, Zing Command-Line Options
-
-
Zing 25.07.0.0 introduces new command line options to manage statistics that are output to the GC log periodically, including system info, compiler stats, and ReadyNow stats logging. These new flags allow you to define two logging periods, Warmup and Steady, and how often stats are written to the log during these periods:
-
-XX:WarmupPeriodForStatsSeconds- Defines the duration of the Warmup phase, in seconds. The default is 300 seconds (5 minutes). -
-XX:SteadyPeriodForStatsSeconds- Defines the duration of the Steady phase, in seconds. The default is 0, which means logging continues indefinitely unless explicitly changed. If you explicitly set this option to 0, the Steady phase is skipped. -
-XX:PeriodicStatsDuringWarmupIntervalSeconds- Controls how frequently logs are printed during the Warmup phase, in seconds. The default is every 5 seconds. -
-XX:PeriodicStatsIntervalSeconds– Controls how frequently logs are printed during the Steady phase, in seconds. The default is every 60 seconds (once per minute).
-
-
Zing 25.0.7.0.0 introduces a new Falcon flag,
-XX:FalconGenerateDiscriminators. This flag improves the quality of debug (DWARF) metadata for Falcon-generated assembly, which is beneficial for some diagnostic tooling. This option is disabled by default. -
Zing 25.07.0.0 includes an improvement which reduces CPU used by the GC early during execution by committing Java heap faster in cases where Xms is not equal to Xmx.
-
July 2025 CPU release security fixes.
CVE fixes
| CVE # | Component | Protocol | Remote Exploit w/o Auth. | Base Score | Attack Vector | Attack Complex | Privileges Req’d | User Interact | Scope | Confiden-tiality | Integrity | Availability | Versions Affected | Notes |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Networking |
Multiple |
Yes |
8.6 |
Network |
Low |
None |
None |
Unchanged |
High |
None |
None |
21, 17, 11, 8 |
Note 1 |
|
Scripting |
Multiple |
Yes |
5.9 |
Network |
High |
None |
None |
Unchanged |
None |
High |
None |
11, 8 |
Note 2 |
|
JSSE |
TLS |
Yes |
4.8 |
Network |
High |
None |
None |
Unchanged |
Low |
Low |
None |
21, 17, 11, 8 |
Note 1 |
|
CVE-2025-30749 This CVE is not applicable to Azul Zing Builds of OpenJDK. It is listed here for comparison with other Java implementations which may contain this CVE. |
2D |
Multiple |
Yes |
8.1 |
Network |
High |
None |
None |
Unchanged |
High |
High |
High |
None |
Note 1 |
CVE-2025-50106 This CVE is not applicable to Azul Zing Builds of OpenJDK. It is listed here for comparison with other Java implementations which may contain this CVE. |
2D |
Multiple |
Yes |
8.1 |
Network |
High |
None |
None |
Unchanged |
High |
High |
High |
None |
Note 2 |
CVE-2025-23166 This CVE is not applicable to Azul Zing Builds of OpenJDK. It is listed here for comparison with other Java implementations which may contain this CVE. |
Oracle GraalVM for JDK |
Multiple |
Yes |
7.5 |
Network |
Low |
None |
None |
Unchanged |
None |
None |
High |
None |
|
CVE-2025-24855 This CVE is not applicable to Azul Zing Builds of OpenJDK. It is listed here for comparison with other Java implementations which may contain this CVE. |
JavaFX (libxslt) |
Multiple |
Yes |
7.5 |
Network |
High |
None |
Required |
Unchanged |
High |
High |
High |
None |
Note 1 |
CVE-2025-27113 This CVE is not applicable to Azul Zing Builds of OpenJDK. It is listed here for comparison with other Java implementations which may contain this CVE. |
JavaFX (libxml2) |
Multiple |
Yes |
7.5 |
Network |
High |
None |
Required |
Unchanged |
High |
High |
High |
None |
Note 1 |
CVE-2025-50063 This CVE is not applicable to Azul Zing Builds of OpenJDK. It is listed here for comparison with other Java implementations which may contain this CVE. |
Install |
None |
No |
7.3 |
Local |
Low |
Low |
Required |
Unchanged |
High |
High |
High |
None |
|
CVE-2025-30752 This CVE is not applicable to Azul Zing Builds of OpenJDK. It is listed here for comparison with other Java implementations which may contain this CVE. |
Compiler |
Multiple |
Yes |
3.7 |
Network |
High |
None |
None |
Unchanged |
None |
None |
Low |
None |
Note 1 |
CVE-2025-50065 This CVE is not applicable to Azul Zing Builds of OpenJDK. It is listed here for comparison with other Java implementations which may contain this CVE. |
Oracle GraalVM for JDK |
HTTP |
Yes |
3.7 |
Network |
High |
None |
None |
Unchanged |
None |
None |
Low |
None |
|
Notes:
| ID | Notes |
|---|---|
1 |
This vulnerability applies to Java deployments, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). |
2 |
This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. |
Additional CVEs addressed are:
-
The patch for CVE-2025-24855 also addresses CVE-2024-55549.
-
The patch for CVE-2025-23166 also addresses CVE-2025-23165.
-
The patch for CVE-2025-27113 also addresses CVE-2024-40896, CVE-2024-56171, CVE-2025-24928, CVE-2025-32414, and CVE-2025-32415.
For more information about CVE and non-CVE security fixes in this release, refer to Common Vulnerabilities and Exposures Fixes for July 2025
Known Issues
| Issue ID | Description |
|---|---|
ZVM-34474 |
Resolved Issues
| Issue ID | Description |
|---|---|
ZVM-35206 |
In some cases, the C1 compiler queue can become unusually deep with high overhead of compile requests, significantly impacting performance. |
ZVM-35296 + ZVM-35247 |
Undefined behavior could cause memory corruption with alternative allocators. |
ZVM-35237 |
Processes not starting on KVM processors. |
ZVM-32921 |
Create .deb packages of JRE bundles |