JDK 22 End of Life: A Guide for Oracle Teams

What Oracle JDK 22 End of Life Means for Your Enterprise

On September 17, 2024, Oracle JDK 22 reached end of life (EOL). Because this is not a Long-Term Support (LTS) release, the end of life date is also the end of active support. There will be no further public updates, security patches, or bug fixes from Oracle for this version. The latest build in the 22 release line is 22.0.2.

If your organization is still running Oracle JDK 22, you are now operating without vendor support. This article explains what that status means in practice, the risks it introduces, the legitimate reasons you might still be on this version, and your options for maintaining a stable, secure environment going forward.

What “End of Life” Means for Oracle JDK 22

When Oracle ends support for a non-LTS release like JDK 22, the following changes take effect:

• No more public patches: Oracle will not release new quarterly security alerts, critical patch updates (CPUs), or bug fixes for JDK 22. The final update is version 22.0.2.
• No vendor technical support: Oracle Support will not accept new service requests for JDK 22 as of September 17, 2024. Any existing cases are closed.
• Continued functionality: The Java runtime itself does not stop working. Applications compiled on or targeting JDK 22 will continue to run as before.
• Third-party ecosystem support: Many third-party libraries, tools, and application servers that target JDK 22 may continue to offer patches or updates, but they depend on the underlying JDK. Without Oracle patching the JDK itself, those fixes may not fully protect you from underlying JDK vulnerabilities.

Risks of Running Oracle JDK 22 Without Support

Running an unsupported JDK in a production environment introduces real operational and security risks:

• Unpatched CVEs: New Common Vulnerabilities and Exposures (CVEs) affecting JDK 22 will not be addressed by Oracle. An attacker who discovers a vulnerability in the 22 codebase can exploit it without hope of a vendor fix.
• Compliance exposure: Regulatory frameworks (PCI DSS, SOX, HIPAA, GDPR) often require that software under support or with active security patches be used in production. Running an unsupported JDK can be flagged during audits.
• Integration drift: As other parts of your infrastructure (operating systems, middleware, databases) receive updates, you may encounter compatibility issues that require JDK-level changes. Without vendor support, you must diagnose and fix those yourself.
• No upgrade path: Oracle will not provide migration assistance or tooling to move from JDK 22 to a later LTS release. You must plan and execute that migration independently.

Why Organizations Are Still Running JDK 22

Despite the risks, many enterprises find themselves stuck on an out-of-support JDK release. Common reasons include:

• Stable workloads: A custom-built application or legacy system was certified on JDK 22 and runs without issues. The cost and risk of re-certifying on a newer LTS release (21 or 17) seem disproportionate.
• Locked application dependencies: Some third-party software components or frameworks require a specific JDK version. Updating the JDK might break that component, forcing a vendor upgrade that isn't budgeted or available.
• Hardware constraints: Older hardware or embedded systems may not support newer JDK versions. JDK 22 might be the last release that runs on that infrastructure.
• Extended validation cycles: Large organizations with strict change management processes often lag several versions behind. They may only now be completing validation of JDK 22, only to find it is already unsupported.

How Third-Party Support Keeps JDK 22 Safe

Third-party maintenance providers offer a practical path for organizations that cannot immediately migrate off JDK 22. Instead of leaving your runtime exposed, you can engage a specialist that delivers:

• Custom backport patches: When a critical CVE or high-severity bug is reported in an upstream JDK release, the third-party provider can backport a fix to JDK 22. This keeps your specific vulnerability surface patched without requiring a full upgrade.
• Technical support: You get access to engineers who understand the JDK 22 codebase and can help troubleshoot runtime issues, performance problems, or integration failures.
• Extended lifecycle management: Third-party support can cover JDK 22 for months or even years beyond Oracle's EOL date, giving you time to plan your migration to a supported LTS release.
• Cost control: Third-party support is typically priced at a fraction of the last Oracle renewal — often 50-70% less. This is especially relevant for non-LTS releases where Oracle's own pricing might be high relative to the short support term.

If you want to understand how a third-party maintenance program can protect your JDK 22 deployments, contact us for a detailed assessment.

Planning Your Next Steps

For most organizations, the best long-term strategy is to migrate to an LTS release (JDK 21, which is supported through September 2028, or JDK 17, supported through September 2027). However, if that migration must wait, third-party support fills the gap securely and cost-effectively.

Don't assume that because your application