OpenJDK 26.0.2

OpenJDK 26.0.2 has been released — the July 2026 Critical Patch Update (CPU) is here, bringing important security fixes, bug patches, and updated time zone data for the JDK 26 series.

Security Fixes Take Center Stage

Oracle has released OpenJDK 26.0.2 as part of its quarterly Critical Patch Update cycle. This release addresses multiple security vulnerabilities across the JDK, with fixes spanning the HotSpot VM, the Java compiler, core libraries, and the security subsystem itself.

Among the notable security changes, the release introduces a new security property — com.sun.security.crl.maxSize — which allows administrators to control the maximum size of Certificate Revocation Lists (CRLs) that the JDK will process. This is a proactive hardening measure aimed at preventing denial-of-service scenarios where oversized CRLs could impact certificate validation performance.

Additionally, certificate parsing has been strengthened with enhancements tracked under JDK-8381796, improving the JDK's resilience against malformed certificate inputs.

IANA Time Zone Data Updated

OpenJDK 26.0.2 ships with IANA time zone data version 2026b. This update reflects recent changes in daylight saving time policies across various regions. Notably, it includes adjustments for British Columbia, which observed its last daylight saving time change, as well as other global time zone rule modifications that have taken effect since the previous update.

Applications that rely on accurate time zone conversions — scheduling systems, logging frameworks, and distributed services — should upgrade to avoid potential timestamp discrepancies.

What Changed Under the Hood

Beyond security and time zone data, this release packages a collection of bug fixes targeting the Java Virtual Machine, the class library, and the build system. The full version string for this update is 26.0.2+10, and binaries are available from Oracle, Adoptium, Microsoft, Azul, and other OpenJDK distributors.

• CRL size limit: New com.sun.security.crl.maxSize property to cap certificate revocation list processing
• Certificate parsing: Enhanced validation for improved security posture
• Time zone data: IANA tzdata 2026b with DST rule changes
• Bug fixes: Multiple reliability improvements across the VM and libraries

Upgrade Considerations

As a quarterly CPU release, OpenJDK 26.0.2 is fully binary compatible with prior 26.x releases. The upgrade path is straightforward — replace your JDK 26.0.1 installation with the new build and verify your application passes its test suite.

If you are running a Java application in production, this release is classified as a recommended upgrade. The security fixes alone make it worth the deployment, and the time zone data update prevents edge-case scheduling bugs that may surface during DST transition periods later this year.

OpenJDK 26.0.2 is available now from all major OpenJDK distributors. Check with your vendor for specific binary builds and installation instructions.