Oracle JDK 17 (LTS) EOL: September 30, 2026

Oracle JDK 17 (LTS) Reached End of Life on September 30, 2026

Oracle JDK 17, the long-term support (LTS) release that succeeded JDK 11, reached its end of life on September 30, 2026. For organizations still running JDK 17—and many will be—this milestone means the end of public patches, security fixes, and vendor support from Oracle. If you are reading this after that date, you are managing an unsupported Java runtime. This article covers exactly what changed, what still works, the practical risks, and the support options that keep your workloads stable.

What End of Life Means for Oracle JDK 17 LTS

Oracle’s end-of-life (EOL) date for JDK 17 (LTS) marks the cutoff for all Premier Support and sustaining updates. After September 30, 2026:

• No new public security patches or bug fixes will be released.
• Oracle will not provide technical support for JDK 17 under any standard subscription.
• The latest update available in the 17.0.x line is version 17.0.20.1. No further updates from Oracle are expected.

This applies only to Oracle’s distribution of JDK 17. OpenJDK builds from other providers (e.g., Eclipse Temurin, Amazon Corretto, Azul Zulu) follow their own lifecycles and may still offer updates for JDK 17. However, this article focuses on Oracle JDK 17 LTS specifically.

What Still Works and What Stops

Your JDK 17 applications will continue to run after the EOL date. The JVM does not stop working, and existing compiled bytecode remains functional. What stops is the flow of official updates from Oracle:

• Security patches: Vulnerabilities discovered after September 30, 2026 will not be addressed by Oracle for JDK 17.
• Bug fixes: Critical stability issues in the runtime libraries or the JVM itself will not receive vendor-backed fixes.
• Compliance certificates: Oracle may update its certificate lists and TLS configurations, but those changes are not backported to unsupported releases.

For workloads that do not require internet access, do not handle sensitive data, and are fully static, JDK 17 can continue to operate indefinitely. For most enterprise environments, the absence of security patches is the primary concern.

Real Risks of Running Unsupported Oracle JDK 17

The risks are practical, not theoretical:

• Security exposure: Any new CVE-level vulnerabilities in the JDK remain unpatched. This can violate compliance frameworks (PCI DSS, SOC 2, HIPAA) that mandate timely patching of known vulnerabilities.
• Regulatory risk: Auditors and compliance reviewers often require vendor-supported software or a documented risk acceptance for unsupported components.
• Operational instability: If a critical bug is discovered in the JIT compiler, garbage collector, or class library, there is no official path to a fix without migrating to a newer JDK version.
• No updates for cryptographic protocols: As TLS and cipher suite standards evolve, an unpatched JDK 17 may fail to connect to updated services or require manual workarounds.

Who Legitimately Stays on JDK 17

Despite the EOL, many organizations have legitimate reasons to remain on JDK 17:

• Stable, air-gapped workloads: Applications that never connect to external networks and have no security requirement to patch.
• Locked application dependencies: Proprietary or legacy applications that only run on JDK 17 and cannot be migrated to JDK 21 or later without significant rework.
• Hardware constraints: Older systems where newer JDK releases (JDK 21, JDK 24) are not certified or cause incompatibilities with specialized hardware drivers.
• Compliance timelines: Some organizations accept the risk while they plan a migration over the next 12–24 months.

In these cases, staying on JDK 17 is a practical decision—but it should be accompanied by a risk mitigation plan.

Third-Party Support: Keeping JDK 17 Maintained

When Oracle stops supporting JDK 17, third-party support providers (like our company) can fill the gap. Third-party support typically costs 40–70% less than the last Oracle renewal. Here’s what it covers:

• Security patches: Custom backported fixes for critical and high-severity CVEs, delivered through a secure mechanism.
• Bug fixes: Resolution of JVM, library, and tooling issues that affect your specific workloads.
• Technical support: Direct access to Java engineers for troubleshooting, performance tuning, and root-cause analysis.
• Lifecycle extension: You can remain on JDK 17 for years beyond Oracle’s EOL, with no forced migration.

This option is especially valuable when migration to a newer JDK is not feasible in the short term. It allows you to maintain security and compliance while keeping your existing application stack stable.

For more details on Oracle JDK lifecycle phases and what we support, see our Oracle software page. If you are evaluating whether third-party support fits your current JDK 17 deployment, contact us for a no-obligation discussion.

Lifecycle source: endoflife.date/oracle-jdk