RELEASE NOTES: JDK 21.0.14

Notes generated: Mon Nov 02 06:15:19 CET 2026

JEPs

None.

RELEASE NOTES

security-libs/javax.crypto

Issue Description
JDK-8371259

ML-DSA AVX2 and AVX512 Intrinsics and Improvements


This feature delivers new intrinsics using AVX2 instructions on x8664 platforms for the ML-DSA signature algorithm in the SUN security provider. This feature also improves the existing AVX512 intrinsics for the ML-DSA algorithm. This optimization is enabled by default on supporting x8664 platforms. It may be disabled by providing the [-XX:+UnlockDiagnosticVMOptions] [-XX:-UseDilithiumIntrinsics] command-line options.

hotspot/runtime

Issue Description
JDK-8359706

VM.info and hs_err_pid Logs Now Report Current Open File Descriptors


The output of the [jcmd] VM.info diagnostic command and HotSpot fatal error logs (hs_err_pid) now include the current number of open file descriptors for the running Java process. On supported platforms, the new output displays the active file descriptor count in the SYSTEM section (for example, Open File Descriptors: 52). This enhancement helps diagnose and troubleshoot resource exhaustion and Too many open files issues on UNIX platforms.

Note that the maximum file descriptor limit for the process is already reported in the same output as the NOFILE value (for example, NOFILE 10240/infinity).

security-libs/java.security

Issue Description
JDK-8343232

PKCS12 KeyStore Support for RFC 9879: Use of Password-Based Message Authentication Code 1 (PBMAC1)


The JDK PKCS12 [KeyStore] implementation now supports the more modern PBMAC1 algorithm for integrity protection. To use the PBMAC1 algorithm, set the keystore.pkcs12.macAlgorithm property in the java.security configuration file to a PBMAC1 algorithm, for example, PBEWithHmacSHA256. Existing PKCS12 keystore files will continue to use the integrity algorithm it was created with, but new keystore files will use the PBMAC1 algorithm.

In a future JDK release, the default value of the keystore.pkcs12.macAlgorithm security property will be changed to a PBMAC1 algorithm.
JDK-8386371

Entrust G4 Root CA Removed


The following root certificate has been removed from the cacerts keystore: ``` + alias name "entrustrootcag4 [jdk]" Distinguished Name: CN=Entrust Root Certification Authority - G4, OU="(c) 2015 Entrust, Inc. - for authorized use only", OU=See www.entrust.net/legal-terms, O="Entrust, Inc.", C=US

```
JDK-8392771

Added Certum Trusted Root CA and Certum EC-384 CA Certificates


The following root certificates have been added to the cacerts truststore: ``` + Certum + certumtrustedrootca DN: CN=Certum Trusted Root CA, OU=Certum Certification Authority, O=Asseco Data Systems S.A., C=PL

  • Certum
  • certumec384ca DN: Certum EC-384 CA, OU=Certum Certification Authority, O=Asseco Data Systems S.A., C=PL ```

FIXED ISSUES

client-libs/2d

Priority Bug Summary
P3 JDK-8386576 Calculating Area using a complex polygon creates spurious horizontal line segments

client-libs/java.awt

Priority Bug Summary
P4 JDK-8379499 [AIX] headless-only build of libjawt.so fails

core-libs/java.lang

Priority Bug Summary
P4 JDK-8379443 Correct build tags in some math tests

core-libs/java.net

Priority Bug Summary
P2 JDK-8392732 test/jdk/java/net/Socket/SetSoLinger.java fails on macos 27 - java.net.SocketException: Numerical argument out of domain
P4 JDK-8387273 Enhance httpserver logging to log when maxConnections is reached
P4 JDK-8375352 java/net/httpclient/ConnectTimeoutWithProxy*.java tests fail on EC2
P4 JDK-8378398 Modernize test/jdk/java/net/URLClassLoader/HttpTest.java
P4 JDK-8373676 Test javax/net/ssl/HttpsURLConnection/SubjectAltNameIP.java fails on a machine without IPV6
P4 JDK-8386595 Two java/net/MulticastSocket tests fail on machines with no ipv6 address other than loopback
P4 JDK-8380534 Use loopback address in java/net/DatagramPacket/ReuseBuf.java test

core-libs/java.nio

Priority Bug Summary
P3 JDK-8390212 (dc) On AIX, DatagramChannel.join can join IPv4 multicast group with IPv6 socket
P4 JDK-8392608 UnixNativeDispatcher.strerror should use given error code

core-libs/java.rmi

Priority Bug Summary
P4 JDK-8170896 TEST_BUG: java/rmi/server/Unreferenced/leaseCheckInterval/LeaseCheckInterval.java failed with unreferenced() not invoked after 20.0 seconds

core-libs/java.time

Priority Bug Summary
P3 JDK-8396048 (tz) Update to tzdata2026f

core-libs/java.util

Priority Bug Summary
P4 JDK-8378833 Improve offset arithmetic in ArraysSupport::mismatch

core-libs/java.util.jar

Priority Bug Summary
P4 JDK-8377461 Add ZipFile test for incorrect number of entries reported in ENDTOT

core-svc/debugger

Priority Bug Summary
P3 JDK-8342659 Test vmTestbase/nsk/jdi/ObjectReference/referringObjects/referringObjects002/referringObjects002.java failed: Class nsk.share.jdi.TestClass1 was not unloaded

core-svc/tools

Priority Bug Summary
P4 JDK-8380896 Reduce runtime for MonitorVmStartTerminate.java on hosts with a lot of VMs

globalization/translation

Priority Bug Summary
P4 JDK-8351223 Update localized resources in keytool and jarsigner

hotspot/compiler

Priority Bug Summary
P3 JDK-8390765 [PPC64] AES Crypto intrinsics may access memory beyond the key array
P3 JDK-8361892 AArch64: Incorrect matching rule leading to improper oop instruction encoding
P3 JDK-8376400 C2: folding ifs may cause incorrect execution when trap is taken
P3 JDK-8339526 C2: store incorrectly removed for clone() transformed to series of loads/stores
P3 JDK-8391881 RISC-V: jni_fast_GetField registers the wrong pc for the speculative load
P3 JDK-8372703 Test compiler/arguments/TestCodeEntryAlignment.java failed: assert(allocates2(pc)) failed: not in CodeBuffer memory
P4 JDK-8391757 [PPC64] C1 runs into assertion with -XX:+VerifyOops
P4 JDK-8386474 Aarch64: Correct static_assert((N & (N - 1)) == 0
P4 JDK-8390521 RISC-V: Clean up vector register dispatch in MachSpillCopyNode::implementation
P4 JDK-8390441 RISC-V: Fix C2 stack-to-stack spill copies with large offsets
P4 JDK-8391041 RISC-V: Fix out-of-bounds read in string_indexof_char intrinsic

hotspot/gc

Priority Bug Summary
P3 JDK-8331695 Serial: DefNewGeneration:_promotion_failed used without being initialized
P3 JDK-8339651 ShenandoahPacer::setup_for_mark, ShenandoahPacer::setup_for_updaterefs and ShenandoahPacer::setup_for_evac runtime error: division by zero
P4 JDK-8388284 [s390] resolve_jobject uses wrong branch condition after tmll

hotspot/jfr

Priority Bug Summary
P3 JDK-8383367 jdk/jfr/event/oldobject/TestDFSWithSmallStack.java failed with -XX:+UseZGC -XX:+UseCompactObjectHeaders

hotspot/jvmti

Priority Bug Summary
P4 JDK-8375367 vmTestbase tests reported variable uninitialized by clang23

hotspot/runtime

Priority Bug Summary
P2 JDK-8380236 macOS build is broken by JDK-8359706
P4 JDK-8359706 Add file descriptor count to VM.info
P4 JDK-8339331 GCC fortify error in vm_version_linux_aarch64.cpp
P4 JDK-8300800 UB: Shift exponent 32 is too large for 32-bit type 'int'

hotspot/svc

Priority Bug Summary
P4 JDK-8379516 Adjust JVM debug helper exports

hotspot/svc-agent

Priority Bug Summary
P4 JDK-8378838 Fix issues with "dead" code elimination and serviceability agent in libjvm.so on Linux

infrastructure

Priority Bug Summary
P4 JDK-8391437 Bump update version for OpenJDK: jdk-21.0.14

infrastructure/build

Priority Bug Summary
P4 JDK-8350801 Add a code signing hook to the JDK build system
P4 JDK-8338063 Passing "|" as argument to TEST fails
P4 JDK-8310369 UTIL_ARG_WITH fails when arg is disabled

security-libs/java.security

Priority Bug Summary
P2 JDK-8392771 Add 2 Certum roots
P2 JDK-8343232 PKCS#12 KeyStore support for RFC 9879: Use of Password-Based Message Authentication Code 1 (PBMAC1)
P3 JDK-8364226 Better ECDSASignature Memory Management
P3 JDK-8342062 Reformat keytool and jarsigner output for keys with a named parameter set
P4 JDK-8386371 Remove Entrust G4 root CA

security-libs/javax.crypto

Priority Bug Summary
P3 JDK-8372547 New test sun/security/provider/acvp/ML_DSA_Intrinsic_Test.java should be restricted to x86_64
P3 JDK-8372816 New test sun/security/provider/acvp/ML_DSA_Intrinsic_Test.java succeeds in case of error
P3 JDK-8373063 Test sun/security/provider/acvp/ML_DSA_Intrinsic_Test.java fails on Aarch64 after JDK-8372816
P3 JDK-8373059 Test sun/security/provider/acvp/ML_DSA_Intrinsic_Test.java should pass on Aarch64
P4 JDK-8371259 ML-DSA AVX2 and AVX512 intrinsics and improvements

security-libs/javax.crypto:pkcs11

Priority Bug Summary
P4 JDK-8388872 Avoid unused variables warnings in libj2pkcs11

security-libs/javax.net.ssl

Priority Bug Summary
P3 JDK-8393697 [21u] Fix issue in backport of 8368514
P3 JDK-8379549 sun/security/ssl/SSLSocketImpl/SSLSocketSSLEngineCloseInbound.java failed with SocketException: Connection reset by peer
P4 JDK-8378379 Remove reference to obsolete jdk.net.usePlainSocketImpl property from SSLSocketReset test
P4 JDK-8392076 Sporadic failure of test InvalidateServerSessionRenegotiate.java
P4 JDK-8392780 Sporadic failure of test ServerRenegoWithTwoVersions.java and NoImpactServerRenego.java
P4 JDK-8382222 sun/security/ssl/SSLSocketImpl/SSLSocketBruteForceClose.java fails sporadically
P4 JDK-8368520 TLS 1.3 KeyUpdate fails with SunPKCS11 provider
P4 JDK-8368514 TLS stateless session ticket decryption fails on some providers
P4 JDK-8366454 TLS1.3 server fails with bad_record_mac when receiving encrypted records with empty body

tools/javac

Priority Bug Summary
P4 JDK-8331030 langtools/tools/javac/tree tests fail with SOE with fastdebug and -Xcomp