Liberica JDK 11.0.33+11: Release Notes
Published: October 20, 2026
1. Version information
This document provides information about Liberica JDK 11.0.33 release. The full version string for this update release is 11.0.33+11. The version number is 11.
Liberica JDK 11 is distributed as .apk, .rpm, .zip, .deb, .pkg, and .tar.gz packages. Please select the most appropriate for your purposes.
2. What’s New
This release contains the following updates and new features.
Notable Changes
This is the list of the notable issues fixed in this release.
| Issue ID | |
|---|---|
JDK-8387123 | Summary: Remove LuxTrust Global Root CA Description: The following root certificate has been removed from the |
JDK-8388214 | Summary: Update Timezone Data to 2026c Description: Briefly: Alberta moved to permanent -06 on 2026-06-18; Morocco moves to permanent +00 on 2026-09-20; More integer overflow bugs have been fixed in zic. |
JDK-8392377 | Summary: Update Timezone Data to 2026d Description: Briefly: Canada’s Northwest Territories moved to permanent -06 on 2026-08-21; Obsolescent settings like TZ='EST5EDT' now conform better to POSIX; Fix security, performance and porting bugs in zic and localtime. |
JDK-8392538 | Summary: Align the JDK with Microsoft’s new timezone names for British Columbia/Alberta Description: Microsoft announced a new timezone name for British Columbia, per https://techcommunity.microsoft.com/blog/dstblog/interim-guidance-for-british-columbia-time-zone-changes-2026/4544988 JDK timezone data needs to be aligned with the registry key updates to allow a Windows user to select a local timezone. |
JDK-8393337 | Summary: Update Timezone Data to 2026e Description: Briefly: Manitoba moves to permanent -05 on 2026-10-31. |
JDK-8393848 | Summary: Align the JDK with Microsoft’s new timezone name for Manitoba Description: Microsoft announced a new timezone name for Manitoba, per https://techcommunity.microsoft.com/blog/dstblog/interim-guidance-for-manitoba-permanent-dst-2026/4562488 JDK timezone data needs to be aligned with the registry key updates to allow a Windows user to select a local timezone. |
Graal support in Liberica JDK 11
Liberica JDK continues to provide support for AOT and Graal JIT. Since in OpenJDK 11 builds these features are deemed experimental and deprecated, it is recommended to compile native executables with Liberica Native Image Kit to avoid errors.
IANA TZ Data version
This release of Liberica JDK 11.0.33 comes with the 2026e version of the in-tree copy of the Time Zone Database. The following are the key features of this version.
Briefly
Manitoba moves to permanent -05 on 2026-10-31.
Changes to future timestamps
Manitoba’s 2026-03-08 spring forward was its last foreseeable clock change, as it moved to permanent -05 thereafter. Model this with its traditional abbreviation EST. Although the change to permanent -05 legally takes place on 2026-10-31, temporarily model the change to occur on 2026-11-01 at 02:00 for the same reason as other recent temporary hacks. (Caution: see NOTE FOR 2026b TEMPORARY HACK FOR CLDR AND CANADA below.)
As the change affects both America/Winnipeg and its backward compatibility link, the obsolescent setting TZ="Canada/Central" will now use the abbreviation EST for affected timestamps, akin to TZ="Canada/Pacific" behavior introduced in 2026b.
Another TZDB release may be needed soon if any of the portions of northwestern Ontario historically aligned with America/Winnipeg do not follow. For now, given the short lead time with Manitoba’s announcement, assume that they will, to avoid creating new zones that may not be needed if no divergence occurs.
NOTE FOR 2026b TEMPORARY HACK FOR CLDR AND CANADA
This temporary hack works around a Canadian timekeeping bug in Unicode CLDR 48 and earlier. Unfortunately it also causes zic 2023d through 2026a, in the default slim mode, to generate a TZif file that does not conform to Internet RFC 9636 §3.3. The buggy file in turn causes some TZif readers, including tzcode itself, to ignore America/Vancouver’s 2026-11-01 02:00 transition from PDT (tm_isdst=1) to MST (tm_isdst=0). Although the buggy file does not cause any known TZif reader to mishandle UT offsets, caution is advised when using zic 2023d through 2026a to compile data from more-recent tz releases. To work around this problem when using these older zic versions, use ‘zic -b fat’.
Changes to past timestamps
In 1925 Ireland fell back on 09-20 not 10-04.
Changes to commentary
Discussion on timekeeping practices in northwestern Ontario has been expanded in light of Manitoba’s recent announcement. It is not yet known whether or to what extent these areas may adapt their own timekeeping practices in response.
For more information, see JDK-8393337.
3. Known Issues
This release does not contain any known issues.
4. Fixed CVEs
This is the list of the security issues fixed in this release. CVSS scores are provided using the CVSS version 3.1 scoring system.
| CVE ID | CVSS score | Component | Module | Attack Vector | Complexity | Privileges | User Interaction | Scope | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|---|---|---|---|---|---|
CVE-2026-101516 | 6.5 | security-libs | java.security | network | low | none | none | unchanged | low | low | none |
CVE-2026-43660 | 7.5 | javafx | web | network | high | none | required | unchanged | high | high | high |
CVE-2026-46470 | 4.2 | javafx | media | network | high | none | required | unchanged | low | none | low |
CVE-2026-6732 | 5.9 | javafx | libxml2 | network | high | none | none | unchanged | none | none | high |
CVE-2026-83374 | 5.9 | security-libs | javax.crypto | network | high | none | none | unchanged | none | high | none |
CVE-2026-83376 | 3.7 | security-libs | java.security | network | high | none | none | unchanged | none | low | none |
CVE-2026-83380 | 5.3 | security-libs | javax.security | network | low | none | none | unchanged | low | none | none |
CVE-2026-83381 | 4.8 | security-libs | javax.security | network | high | none | none | unchanged | low | low | none |
CVE-2026-83387 | 5.9 | core-libs | java.sql | network | high | none | none | unchanged | high | none | none |
CVE-2026-83395 | 3.7 | core-libs | java.net | network | high | none | none | unchanged | none | low | none |
CVE-2026-83400 | 5.3 | xml | jaxp | network | low | none | none | unchanged | none | none | low |
CVE-2026-87290 | 3.7 | xml | jaxp | network | high | none | none | unchanged | low | none | none |
CVE-2026-87292 | 3.7 | core-libs | java.net | network | high | none | none | unchanged | none | low | none |
CVE-2026-87294 | 6.5 | security-libs | java.security | network | low | none | none | unchanged | low | low | none |
CVE-2026-87367 | 3.7 | xml | jaxp | network | high | none | none | unchanged | none | low | none |
CVE-2026-91332 | 5.3 | core-libs | java.net | network | low | none | none | unchanged | none | low | none |
CVE-2026-91334 | 3.7 | client-libs | javax.imageio | network | high | none | none | unchanged | low | none | none |
CVE-2026-91335 | 2.6 | client-libs | java.awt | network | high | low | required | unchanged | low | none | none |
CVE-2026-91373 | 5.3 | security-libs | java.security | network | low | none | none | unchanged | none | none | low |
CVE-2026-91374 | 4.8 | core-svc | tools | network | high | none | none | unchanged | low | low | none |
CVE-2026-91375 | 4.7 | tools | jlink | local | high | none | required | unchanged | none | high | none |
CVE-2026-91379 | 4.7 | tools | jshell | local | high | none | required | unchanged | none | high | none |
CVE-2026-91380 | 4.0 | core-libs | java.util | local | high | none | none | unchanged | low | low | none |
CVE-2026-91382 | 6.5 | client-libs | 2d | network | high | none | none | unchanged | none | high | low |
CVE-2026-91385 | 5.4 | javafx | web | network | low | none | required | unchanged | low | low | none |
CVE-2026-91394 | 5.9 | core-libs | java.net | network | high | none | none | unchanged | high | none | none |
CVE-2026-91395 | 6.5 | core-libs | java.util.jar | network | low | none | none | unchanged | none | low | low |
CVE-2026-91396 | 6.5 | core-libs | java.util.jar | network | low | none | none | unchanged | none | low | low |
CVE-2026-91397 | 3.6 | core-svc | tools | local | high | none | required | unchanged | none | low | low |
CVE-2026-91398 | 6.8 | core-libs | java.net | network | high | none | none | changed | none | high | none |
CVE-2026-91400 | 3.1 | client-libs | javax.sound | network | high | none | required | unchanged | none | none | low |
CVE-2026-91402 | 3.1 | javafx | graphics | network | high | none | required | unchanged | low | none | none |
CVE-2026-91410 | 5.3 | core-libs | java.nio | network | low | none | none | unchanged | none | none | low |
CVE-2026-91411 | 6.5 | security-libs | org.ietf.jgss | network | high | none | none | unchanged | none | low | high |
CVE-2026-91415 | 4.8 | client-libs | 2d | network | high | none | none | unchanged | low | low | none |
CVE-2026-91418 | 5.3 | client-libs | javax.imageio | network | low | none | none | unchanged | none | none | low |
CVE-2026-91451 | 5.3 | core-libs | java.net | network | low | none | none | unchanged | none | low | none |
CVE-2026-91452 | 5.3 | core-libs | java.net | network | low | none | none | unchanged | none | low | none |
CVE-2026-91453 | 5.3 | core-libs | java.net | network | low | none | none | unchanged | none | low | none |
CVE-2026-91461 | 3.7 | security-libs | javax.net.ssl | network | high | none | none | unchanged | none | low | none |
CVE-2026-91462 | 5.9 | security-libs | org.ietf.jgss | network | high | none | none | unchanged | none | high | none |
CVE-2026-91463 | 5.3 | security-libs | org.ietf.jgss | network | high | none | required | unchanged | high | none | none |
CVE-2026-91464 | 5.3 | security-libs | org.ietf.jgss | network | high | none | required | unchanged | high | none | none |
CVE-2026-91487 | 4.8 | hotspot | compiler | network | high | none | none | unchanged | low | low | none |
5. Resolved Issues
JDK issues
This is the list of general JDK issues fixed in this release.
| Issue ID | Summary |
|---|---|
JDK-8243246 | HTTP Client sometimes gets java.io.IOException → Invalid chunk header byte 32 |
JDK-8254871 | Remove unnecessary string copy in NetworkInterface.c |
JDK-8255380 | (zipfs) ZipFileSystem::readExtra can fail if zipinfo-time is not set to false |
JDK-8265192 | [macos_aarch64] configure script fails if GNU uname in PATH |
JDK-8267617 | Certificate’s IP x509 NameConstraints raises ArrayIndexOutOfBoundsException |
JDK-8270915 | GIFImageReader disregards ignoreMetadata flag which causes memory exhaustion |
JDK-8272746 | ZipFile can’t open big file (NegativeArraySizeException) |
JDK-8277444 | Data race between JvmtiClassFileReconstituter::copy_bytecodes and class linking |
JDK-8283562 | JDK-8282306 breaks gtests on zero |
JDK-8285630 | Fix a configure error in RISC-V cross build |
JDK-8290368 | Introduce LDAP and RMI protocol-specific object factory filters to JNDI implementation |
JDK-8298240 | Replace the usage of ImageLayoutException by the CMMException |
JDK-8300167 | Add validation of the raster’s layout before using in native |
JDK-8300805 | Update autoconf build-aux files with latest from 2022-09-17 |
JDK-8304013 | Add a fast, non-manual alternative to test/jdk/java/util/zip/ZipFile/TestTooManyEntries |
JDK-8305481 | gtest is_first_C_frame failing on ARM |
JDK-8310687 | JDK-8303215 is incomplete |
JDK-8312182 | THPs cause huge RSS due to thread start timing issue |
JDK-8312585 | Rename DisableTHPStackMitigation flag to THPStackMitigation |
JDK-8314139 | TEST_BUG: runtime/os/THPsInThreadStackPreventionTest.java could fail on machine with large number of cores |
JDK-8316391 | (zipfs) ZipFileSystem.readFullyAt does not tolerate short reads |
JDK-8317126 | Redundant entries in Windows |
JDK-8325680 | Uninitialised memory in deleteGSSCB of GSSLibStub.c:179 |
JDK-8341625 | Improve ZipFile validation of the END header |
JDK-8343788 | Provide means to alter lib/tzmappings entries on Windows |
JDK-8347000 | Bug in com/sun/net/httpserver/bugs/B6361557.java test |
JDK-8359735 | [Ubuntu 25.10] java/lang/ProcessBuilder/Basic.java, java/lang/ProcessHandle/InfoTest.java fail due to rust-coreutils |
JDK-8365776 | Convert JShell tests to use JUnit instead of TestNG |
JDK-8373677 | Clear text HttpServer connection could fail fast if receiving SSL ClientHello |
JDK-8374434 | Several JShell tests report JUnit discovery warnings |
JDK-8377983 | (zipfs) ZipFileSystem.initCEN needlessly reads END header |
JDK-8377992 | (zipfs) Align ZipFileSystem END header validation with the ZipFile implementation |
JDK-8378180 | Compiling OpenJDK with C23 C-Compiler gives warning: initialization discards ‘const’ qualifier from pointer target type |
JDK-8380223 | Refactor test/jdk/sun/util/resources TestNG tests to JUnit |
JDK-8380715 | Enhance PKCS5 padding |
JDK-8380993 | [REDO] Incorrect Interpretation of POSIX TZ Environment Variable on AIX |
JDK-8381379 | Support std/dstOffset attributes in CLDR’s metazone definitions |
JDK-8382178 | Enhance TLS certificate handling |
JDK-8382407 | Enhance LDAP Lookups |
JDK-8383047 | Enhance LDAP logins |
JDK-8383076 | Enhance SASL Authentication |
JDK-8383281 | Enhance MD5 Digesting |
JDK-8383301 | Enhance WebRowSets |
JDK-8383439 | Enhance HTTP Client Response Handling |
JDK-8383530 | Enhance Javadoc Searching |
JDK-8383679 | Enhance Certificate Name Checks |
JDK-8383699 | Enhance XPath Expressions |
JDK-8383756 | Enhance Network Clients |
JDK-8384021 | Enhance Certificate Constraint Checking |
JDK-8384031 | Enhance XML Processing |
JDK-8384445 | Enhance JPEG loading |
JDK-8384455 | Enhance DataFlavor |
JDK-8384654 | Enhance Template Handling |
JDK-8384664 | Enhance Image Handling |
JDK-8384688 | Enhance jmod handling |
JDK-8384736 | Enhance JShell 8387235: JShell tests failing |
JDK-8384746 | Enhance Preferences |
JDK-8384771 | Enhance TLS handshakes |
JDK-8384872 | Enhance HTTP Client |
JDK-8384930 | Enhance jstatd |
JDK-8385209 | Enhance HTTP client caching |
JDK-8385219 | Enhance Pack200 unpacking |
JDK-8385229 | Improve Pack200 handling |
JDK-8385249 | Enhance diagnostic sessions |
JDK-8385260 | Enhance SOCKS5 support |
JDK-8385390 | Update FreeType to 2.14.3 |
JDK-8385476 | Enhance MIDI file handling |
JDK-8386013 | Enhance EventListenerList |
JDK-8386187 | Enhance font rendering |
JDK-8386277 | Bump update version of OpenJDK: 11.0.33 |
JDK-8386515 | Enhance HTTP server parsing |
JDK-8386525 | Enhance HTTP Server Handler |
JDK-8386535 | Improve HTTP headers |
JDK-8386552 | Enhance GIF loading |
JDK-8386783 | WebRowSet empty elements read value of previous element |
JDK-8386923 | Enhance TLS Extensions |
JDK-8386991 | Insets are incorrectly set in newer Gnome versions |
JDK-8387123 | Remove LuxTrust Global Root CA |
JDK-8387152 | Enhance krb5 tokens |
JDK-8387217 | Enhance krb5 client |
JDK-8387238 | Enhance Kerberos validation |
JDK-8388214 | (tz) Update Timezone Data to 2026c |
JDK-8390380 | Cherry-pick metazone changes from CLDR to support tzdata2026c for JDK update releases |
JDK-8390388 | Cherry-pick tz attributes from newer CLDR data for jdk25u and earlier |
JDK-8390400 | Enhance C2 comparisons |
JDK-8391256 | TestZoneTextPrinterParser.java assertion fails with expected: <Mountain Standard Time> but was: <Mountain Daylight Time> |
JDK-8391807 | Inconsistent TimeZone Names Displayed across JDK release trains |
JDK-8392072 | Follow-on fix for Improve certification checking |
JDK-8392377 | (tz) Update Timezone Data to 2026d |
JDK-8392519 | Cherry-pick metazone changes from CLDR for tzdata2026d, for JDK update release |
JDK-8392538 | Align the JDK with Microsoft’s new timezone names for British Columbia/Alberta |
JDK-8393337 | (tz) Update Timezone Data to 2026e |
JDK-8393344 | Cherry-pick metazone changes from CLDR to support tzdata2026e for JDK update releases |
JDK-8393848 | Align the JDK with Microsoft’s new timezone name for Manitoba |
JDK-8394265 | [21u] Add explicit zone offset test for America/Rainy_River |
JDK-8394772 | [17u] Update tzmappings.override location after JDK-8343788 backport |
JFX issues
This is the list of JFX issues fixed in this release.
| Issue ID | Summary |
|---|---|
JDK-8272808 | Update constant collections to use the new immutable collections - leftovers |
JDK-8281384 | Random chars on paste from Windows clipboard |
JDK-8329874 | JavaFX debug builds fail on Linux |
JDK-8340564 | [macOS] Intermittent build failure in native font with parallel compilation |
JDK-8361644 | Update ICU4C to 77.1 |
JDK-8367374 | JavaFX debug builds fail on Windows |
JDK-8379561 | Remove UNICODE related code from GLib |
JDK-8380556 | Update WebKit to 625.1 |
JDK-8383209 | Improve JavaFX Scripting Support |
JDK-8383219 | Enhance JavaFX Document Loading |
JDK-8383229 | Enhance JavaFX Image Loading |
JDK-8383252 | Enhance JavaFX DnD |
JDK-8383322 | Enhance JavaFX Clipboard |
JDK-8383332 | Improve JavaFX Input Methods |
JDK-8383333 | Improve JavaFX Drag and Drop |
JDK-8384522 | Update libxml2 to 2.15.3 |
JDK-8384809 | Update GStreamer to 1.28.3 |
JDK-8385198 | Enhance JavaFX Resource Loading |
JDK-8386486 | Improve graphics rendering |
JDK-8386859 | WebView crashes when calling document.startViewTransition() |
JDK-8387337 | GlassClipboard: Replace deprecated hash_map and hash_set |
JDK-8388451 | Additional WebKit 625.1 fixes from WebKitGTK 2.52.5 |
JDK-8388783 | Custom String data cannot be read from the clipboard after JDK-8383252 |
JDK-8389515 | Memory leak in dshowwrapper - decoded buffers delivered by CSink are never unmapped |
JDK-8389783 | Crash in JavaFX native glass toolkit during Timer shutdown |
JDK-8390652 | Additional WebKit 625.1 fixes from WebKitGTK 2.52.6 |
6. Updates to Third Party Libraries
This is the list of changes in the third party libraries.
| Library | Full name | New Version | Module | JBS number |
|---|---|---|---|---|
FreeType | FreeType | 2.14.3 | java.desktop | JDK-8385390 |
7. Upgrading to the New Version
To keep your Liberica JDK up-to-date and secure, always upgrade to the newest available version once it is released. To upgrade, install the new version over the previous one. For the installation instructions, see Liberica JDK Installation Guide.