RELEASE NOTES: JDK 11.0.33

Notes generated: Mon Nov 02 05:14:28 CET 2026

JEPs

None.

RELEASE NOTES

security-libs/java.security

Issue Description
JDK-8387123

LuxTrust Global Root CA Removed


The following root certificate has been removed from the cacerts keystore: ``` + alias name "luxtrustglobalrootca [jdk]" Distinguished Name: CN=LuxTrust Global Root, O=LuxTrust s.a., C=LU

```

core-libs/javax.naming

Issue Description
JDK-8290368

Introduce LDAP and RMI Protocol Specific Object Factory Filters to JNDI Implementation


In this release, new system and security properties are introduced to allow more granular control over the set of JNDI object factories allowed to reconstruct Java objects from JNDI/LDAP and JNDI/RMI contexts:

  • The new jdk.jndi.ldap.object.factoriesFilter property specifies which object factory classes are allowed to instantiate Java objects from object references returned by JNDI/LDAP contexts. Its default value only allows object factories defined in the java.naming module.

  • The new jdk.jndi.rmi.object.factoriesFilter property specifies which object factory classes are allowed to instantiate Java objects from object references returned by JNDI/RMI contexts. Its default value only allows object factories defined in the jdk.rmi module.

These new factory filter properties complement the jdk.jndi.object.factoriesFilter global factories filter property by determining if a specific object factory is permitted to instantiate objects for the LDAP or RMI protocols used in JNDI.

An application depending on custom object factories to recreate Java objects from JNDI/LDAP or JNDI/RMI contexts will need to supply a security or system property with an updated value to allow such third-party object factories to reconstruct LDAP or RMI objects. If usage of a factory is denied, the lookup operation may result in a plain instance of javax.naming.Reference instance returned, which may lead to a ClassCastException being thrown in the application.

For more information, see the java.naming and jdk.naming.rmi module-info documentation.

Introduce LDAP and RMI Protocol Specific Object Factory Filters to JNDI Implementation


In this release, new system and security properties are introduced to allow more granular control over the set of JNDI object factories allowed to reconstruct Java objects from JNDI/LDAP and JNDI/RMI contexts:

  • The new jdk.jndi.ldap.object.factoriesFilter property specifies which object factory classes are allowed to instantiate Java objects from object references returned by JNDI/LDAP contexts. Its default value only allows object factories defined in the java.naming module.

  • The new jdk.jndi.rmi.object.factoriesFilter property specifies which object factory classes are allowed to instantiate Java objects from object references returned by JNDI/RMI contexts. Its default value only allows object factories defined in the jdk.naming.rmi module.

These new factory filter properties complement the jdk.jndi.object.factoriesFilter global factories filter property by determining if a specific object factory is permitted to instantiate objects for the LDAP or RMI protocols used in JNDI.

An application depending on custom object factories to recreate Java objects from JNDI/LDAP or JNDI/RMI contexts will need to supply a security or system property with an updated value to allow such third-party object factories to reconstruct LDAP or RMI objects. If usage of a factory is denied, the lookup operation may result in a plain instance of javax.naming.Reference instance returned, which may lead to a ClassCastException being thrown in the application.

Introduce LDAP and RMI Protocol Specific Object Factory Filters to JNDI Implementation


In this release, new system and security properties are introduced to allow more granular control over the set of JNDI object factories allowed to reconstruct Java objects from JNDI/LDAP and JNDI/RMI contexts:

  • The new jdk.jndi.ldap.object.factoriesFilter property specifies which object factory classes are allowed to instantiate Java objects from object references returned by JNDI/LDAP contexts. By default, only object factories defined with the setting of the property 'jdk.jndi.ldap.object.factoriesFilter=com.sun.jndi.ldap.*;!' are allowed.

  • The new jdk.jndi.rmi.object.factoriesFilter property specifies which object factory classes are allowed to instantiate Java objects from object references returned by JNDI/RMI contexts. By default, only object factories defined with the setting of the property jdk.jndi.rmi.object.factoriesFilter=com.sun.jndi.rmi.**;!* are allowed.

These new factory filter properties complement the jdk.jndi.object.factoriesFilter global factories filter property by determining if a specific object factory is permitted to instantiate objects for the LDAP or RMI protocols used in JNDI.

An application depending on custom object factories to recreate Java objects from JNDI/LDAP or JNDI/RMI contexts will need to supply a security or system property with an updated value to allow such third-party object factories to reconstruct LDAP or RMI objects. If usage of a factory is denied, the lookup operation may result in a plain instance of javax.naming.Reference instance returned, which may lead to a ClassCastException being thrown in the application.

FIXED ISSUES

client-libs/2d

Priority Bug Summary
P4 JDK-8300167 Add validation of the raster's layout before using in native
P4 JDK-8298240 Replace the usage of ImageLayoutException by the CMMException

client-libs/java.awt

Priority Bug Summary
P3 JDK-8386991 Insets are incorrectly set in newer Gnome versions

client-libs/javax.imageio

Priority Bug Summary
P3 JDK-8270915 GIFImageReader disregards ignoreMetadata flag which causes memory exhaustion

core-libs

Priority Bug Summary
P3 JDK-8378180 Compiling OpenJDK with C23 C-Compiler gives warning: initialization discards ‘const’ qualifier from pointer target type
P4 JDK-8254871 Remove unnecessary string copy in NetworkInterface.c

core-libs/java.lang

Priority Bug Summary
P4 JDK-8359735 [Ubuntu 25.10] java/lang/ProcessBuilder/Basic.java, java/lang/ProcessHandle/InfoTest.java fail due to rust-coreutils

core-libs/java.net

Priority Bug Summary
P4 JDK-8347000 Bug in com/sun/net/httpserver/bugs/B6361557.java test
P4 JDK-8373677 Clear text HttpServer connection could fail fast if receiving SSL ClientHello
P4 JDK-8243246 HTTP Client sometimes gets java.io.IOException -> Invalid chunk header byte 32

core-libs/java.nio

Priority Bug Summary
P4 JDK-8377992 (zipfs) Align ZipFileSystem END header validation with the ZipFile implementation
P4 JDK-8377983 (zipfs) ZipFileSystem.initCEN needlessly reads END header
P4 JDK-8316391 (zipfs) ZipFileSystem.readFullyAt does not tolerate short reads
P4 JDK-8255380 (zipfs) ZipFileSystem::readExtra can fail if zipinfo-time is not set to false

core-libs/java.time

Priority Bug Summary
P3 JDK-8388214 (tz) Update Timezone Data to 2026c
P3 JDK-8393337 (tz) Update Timezone Data to 2026e
P3 JDK-8396048 (tz) Update to tzdata2026f
P3 JDK-8394265 [21u] Add explicit zone offset test for America/Rainy_River
P3 JDK-8391807 Inconsistent TimeZone Names Displayed across JDK release trains
P4 JDK-8392377 (tz) Update Timezone Data to 2026d
P4 JDK-8391256 TestZoneTextPrinterParser.java assertion fails with expected: but was:

core-libs/java.util.jar

Priority Bug Summary
P4 JDK-8304013 Add a fast, non-manual alternative to test/jdk/java/util/zip/ZipFile/TestTooManyEntries
P4 JDK-8341625 Improve ZipFile validation of the END header
P4 JDK-8272746 ZipFile can't open big file (NegativeArraySizeException)

core-libs/java.util:i18n

Priority Bug Summary
P3 JDK-8393848 Align the JDK with Microsoft's new timezone name for Manitoba
P3 JDK-8392538 Align the JDK with Microsoft's new timezone names for British Columbia/Alberta
P3 JDK-8392519 Cherry-pick metazone changes from CLDR for tzdata2026d, for JDK update release
P3 JDK-8390380 Cherry-pick metazone changes from CLDR to support tzdata2026c for JDK update releases
P3 JDK-8390388 Cherry-pick tz attributes from newer CLDR data for jdk25u and earlier
P4 JDK-8394772 [17u] Update tzmappings.override location after JDK-8343788 backport
P4 JDK-8380993 [REDO] Incorrect Interpretation of POSIX TZ Environment Variable on AIX
P4 JDK-8393344 Cherry-pick metazone changes from CLDR to support tzdata2026e for JDK update releases
P4 JDK-8343788 Provide means to alter lib/tzmappings entries on Windows
P4 JDK-8317126 Redundant entries in Windows `tzmappings` file
P4 JDK-8380223 Refactor test/jdk/sun/util/resources TestNG tests to JUnit
P4 JDK-8381379 Support std/dstOffset attributes in CLDR's metazone definitions

core-libs/javax.naming

Priority Bug Summary
P3 JDK-8290368 Introduce LDAP and RMI protocol-specific object factory filters to JNDI implementation

core-svc/tools

Priority Bug Summary
P3 JDK-8395369 Adjust aix VirtualMachineImpl.c to latest changes on Linux

hotspot/jvmti

Priority Bug Summary
P4 JDK-8277444 Data race between JvmtiClassFileReconstituter::copy_bytecodes and class linking

hotspot/runtime

Priority Bug Summary
P3 JDK-8312182 THPs cause huge RSS due to thread start timing issue
P4 JDK-8305481 gtest is_first_C_frame failing on ARM
P4 JDK-8283562 JDK-8282306 breaks gtests on zero
P4 JDK-8310687 JDK-8303215 is incomplete
P4 JDK-8312585 Rename DisableTHPStackMitigation flag to THPStackMitigation
P4 JDK-8314139 TEST_BUG: runtime/os/THPsInThreadStackPreventionTest.java could fail on machine with large number of cores

infrastructure/build

Priority Bug Summary
P3 JDK-8300805 Update autoconf build-aux files with latest from 2022-09-17
P4 JDK-8265192 [macos_aarch64] configure script fails if GNU uname in PATH
P4 JDK-8285630 Fix a configure error in RISC-V cross build

infrastructure/release_eng

Priority Bug Summary
P4 JDK-8396214 [11u] Remove designator DEFAULT_PROMOTED_VERSION_PRE=ea for release 11.0.33
P4 JDK-8386277 Bump update version of OpenJDK: 11.0.33

security-libs/java.security

Priority Bug Summary
P4 JDK-8267617 Certificate's IP x509 NameConstraints raises ArrayIndexOutOfBoundsException
P4 JDK-8392072 Follow-on fix for Improve certification checking
P4 JDK-8387123 Remove LuxTrust Global Root CA

security-libs/org.ietf.jgss

Priority Bug Summary
P3 JDK-8325680 Uninitialised memory in deleteGSSCB of GSSLibStub.c:179

tools/jshell

Priority Bug Summary
P4 JDK-8365776 Convert JShell tests to use JUnit instead of TestNG
P4 JDK-8374434 Several JShell tests report JUnit discovery warnings