Visit Azul.com Support

26.08.0.0

Need help?
Schedule a consultation with an Azul performance expert.
Contact Us

26.08.0.0

Release Notes PDF

Release date: August 31, 2026

This PSU and CSPU for PSU release is based on the Azul Zing Build of OpenJDK (Zing) 26.07.0.0 and corresponds to the following OpenJDK versions:

Major Version OpenJDK Version

8

1.8.0_504-b2

11

11.0.32.1+9-LTS

17

17.0.20.1+8-LTS

21

21.0.12.1+8-LTS

25

25.04.1+7

What’s New

  • Zing 26.08.0.0 implements a new feature with Optimizer Hub, Compilation Streaming, which allows the JVM to download a stream of pre-compiled code from Optimizer Hub at startup and install it directly, reducing compilation queue time during warmup.

    Zing 26.08.0.0 contains the client-side implementation of Compilation Streaming, released in preparation for Optimizer Hub 26.08.0. Using the feature requires Optimizer Hub 26.08.0 or later, with compilationStreaming.enabled and taskExecutor.enabled both set in the Optimizer Hub configuration. Until Optimizer Hub 26.08.0 is available, enabling -XX:+CNCEnableCompilationStreaming has no effect: the JVM finds no stream to download and continues to run normally, without reporting an error.

    You can control Compilation Streaming using the following command line options:

    Command-Line Option Description Default

    -XX:[+/-]CNCEnableCompilationStreaming

    Enables compilation streaming. The JVM connects to Optimizer Hub and downloads a compiled-code stream at startup. Cannot be used together with Indirect Delivery of the ReadyNow Orchestrator profile, where the JVM downloads the profile over HTTP from a pre-signed URI instead of over gRPC from Optimizer Hub.

    false

    -XX:CNCCompilationStreamingMaxActiveSegments=<number>

    The number of stream segments held in memory at the same time. Each segment contains 500 compilations by default. A value of 3 to 5 suits most production workloads.

    6

    -XX:CNCCompilationStreamingStopAfterSeconds=<value in seconds>

    Stops compilation streaming and frees its memory this many seconds after the VM starts. -1 never stops streaming, and 0 stops it immediately.

    600

    -XX:[+/-]CNCCompilationStreamingPrintStatsAtExit

    Prints a summary of stream installation successes and failures when the JVM exits. Useful during initial validation and performance testing.

    false

  • Methods compiled at a reduced optimization level during local fallback are guaranteed to be recompiled at their intended level once Cloud Native Compiler (CNC) becomes reachable again.

  • ThreadOpt (-XX:+UseThreadOpt and -XX:ThreadOptOptions) has been deprecated in Zing 26.08.0.0 and prints a warning when used. See Monitoring Thread CPU Time Use for details.

  • The experimental -XX:+UseZlibNG option can now be enabled on JDK 25. See Using zlib-ng for details.

CVE fixes
CVE # Component Protocol Remote Exploit w/o Auth. Base Score Attack Vector Attack Complex Privileges Req’d User Interact Scope Confiden-tiality Integrity Availability Versions Affected Notes

CVE-2026-41254

2D (Little CMS)

Multiple

Yes

7.5

Network

Low

None

None

Unchanged

None

None

High

25, 21, 17, 11, 8

Note 1

CVE-2026-47057

Scripting

Multiple

Yes

7.5

Network

Low

None

None

Unchanged

None

None

High

11, 8

Note 1

CVE-2026-47063

Libraries

Multiple

Yes

7.5

Network

Low

None

None

Unchanged

None

High

None

25, 21, 17, 11, 8

Note 1

CVE-2026-47058

Scripting

Multiple

Yes

7.4

Network

High

None

None

Unchanged

High

High

None

11, 8

Note 1

CVE-2026-60147

Security

Multiple

Yes

6.5

Network

Low

None

None

Unchanged

Low

Low

None

25, 21, 17, 11, 8

Note 1

CVE-2026-46968

JSSE

TLS

Yes

5.9

Network

High

None

None

Unchanged

None

High

None

25, 21, 17, 11, 8

Note 2

CVE-2026-46917

JSSE

TLS

Yes

5.3

Network

Low

None

None

Unchanged

None

None

Low

25, 21, 17, 11

Note 2

CVE-2026-47021

2D

Multiple

Yes

5.3

Network

Low

None

None

Unchanged

None

None

Low

25, 21, 17, 11, 8

Note 1

CVE-2026-47027

Libraries

Multiple

Yes

5.3

Network

Low

None

None

Unchanged

None

None

Low

25, 21, 17, 11, 8

Note 1

CVE-2026-47010

ImageIO

Multiple

Yes

3.7

Network

High

None

None

Unchanged

None

Low

None

25, 21, 17, 11, 8

Note 1

CVE-2026-47059

2D

Multiple

Yes

3.7

Network

High

None

None

Unchanged

None

None

Low

25, 21, 17, 11, 8

Note 3

CVE-2026-62574 This CVE is not applicable to Azul Zing Builds of OpenJDK. It is listed here for comparison with other Java implementations which may contain this CVE.

Install

None

No

7.8

Local

Low

Low

None

Unchanged

High

High

High

None

CVE-2026-60526 This CVE is not applicable to Azul Zing Builds of OpenJDK. It is listed here for comparison with other Java implementations which may contain this CVE.

Installation

None

No

6.7

Local

High

Low

Required

Unchanged

High

High

High

None

Note 1

CVE-2026-47013 This CVE is not applicable to Azul Zing Builds of OpenJDK. It is listed here for comparison with other Java implementations which may contain this CVE.

JavaFX

Multiple

Yes

5.3

Network

Low

None

None

Unchanged

None

None

Low

None

Note 1

CVE-2026-47030 This CVE is not applicable to Azul Zing Builds of OpenJDK. It is listed here for comparison with other Java implementations which may contain this CVE.

JavaFX

Multiple

Yes

3.1

Network

High

None

Required

Unchanged

None

Low

None

None

Note 3

CVE-2026-47034 This CVE is not applicable to Azul Zing Builds of OpenJDK. It is listed here for comparison with other Java implementations which may contain this CVE.

JavaFX

Multiple

Yes

3.1

Network

High

None

Required

Unchanged

None

Low

None

None

Note 3

CVE-2026-47035 This CVE is not applicable to Azul Zing Builds of OpenJDK. It is listed here for comparison with other Java implementations which may contain this CVE.

JavaFX

Multiple

Yes

3.1

Network

High

None

Required

Unchanged

None

Low

None

None

Note 3

CVE-2026-60164 This CVE is not applicable to Azul Zing Builds of OpenJDK. It is listed here for comparison with other Java implementations which may contain this CVE.

JavaFX

Multiple

Yes

3.1

Network

High

None

Required

Unchanged

Low

None

None

None

Note 3

CVE-2026-60165 This CVE is not applicable to Azul Zing Builds of OpenJDK. It is listed here for comparison with other Java implementations which may contain this CVE.

JavaFX

Multiple

Yes

3.1

Network

High

None

Required

Unchanged

None

Low

None

None

Note 3

CVE-2026-60166 This CVE is not applicable to Azul Zing Builds of OpenJDK. It is listed here for comparison with other Java implementations which may contain this CVE.

JavaFX

Multiple

Yes

3.1

Network

High

None

Required

Unchanged

Low

None

None

None

Note 3

Notes:

ID Notes

1

This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security.

2

This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java code, such as through a web service.

3

This vulnerability applies to Java deployments, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).

For more information about CVE and non-CVE security fixes in this release, refer to Common Vulnerabilities and Exposures Fixes for July 2026

  • August 2026 CSPU for PSU release security fixes.

CVE fixes
CVE # Component Protocol Remote Exploit w/o Auth. Base Score Attack Vector Attack Complex Privileges Req’d User Interact Scope Confiden-tiality Integrity Availability Versions Affected Notes

CVE-2026-70906

2D

Multiple

Yes

7.5

Network

Low

None

None

Unchanged

None

None

High

25

Note 1

CVE-2026-61308

Networking

HTTP

Yes

6.8

Network

High

None

None

Changed

High

None

None

25, 21, 17, 11, 8

Note 1

CVE-2026-70907

JSSE

TLS

Yes

5.3

Network

Low

None

None

Unchanged

None

None

Low

25, 21, 17, 11, 8

Note 2

CVE-2026-60589

Security

Multiple

Yes

3.7

Network

High

None

None

Unchanged

Low

None

None

25, 21, 17, 11, 8

Note 2

CVE-2026-62574 This CVE is not applicable to Azul Zing Builds of OpenJDK. It is listed here for comparison with other Java implementations which may contain this CVE.

Install

None

No

7.8

Local

Low

Low

None

Unchanged

High

High

High

None

Note 1

Notes:

ID Notes

1

This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security.

2

This vulnerability can only be exploited by supplying data to APIs in the specified Component such as through a web service.

For more information about CVE and non-CVE security fixes in this release, refer to Common Vulnerabilities and Exposures Fixes for August 2026

Known Issues

  • The JVM can crash while resolving a compilation from a compilation stream. Use Compilation Streaming with caution in this release.

Resolved Issues

Issue ID Description

ZVM-39512

Runtime bundles ship unstripped librpc.so and librpccpp.so, significantly increasing bundle size.

ZVM-39506

JFR chunk file writes performed while holding the JVM lock can cause multi-second time to safepoint stalls.

ZVM-38683

Crash in non-ZST mode when -XX:+UseLargePages is used with a huge page size other than 2 MB, such as 512 MB or 1 GB.

ZVM-35539

Crash in AsyncGetCallTrace when ucontext is null, affecting some async-profiler modes.