Liberica JDK 27.0.1.0.2+5: Release Notes
Published: October 22, 2026
1. Version information
This document provides information about an unscheduled patch release for vulnerability fixes in Liberica JDK 27.0.1.0.2. The full version string for this update release is 27.0.1.0.2+5. The version number is 27.
Liberica JDK 27 is distributed as .apk, .rpm, .zip, .deb, .pkg, and .tar.gz packages. Please select the most appropriate for your purposes.
2. What’s New
This release contains the following updates and new features.
Removed the compromised eMudhra certificates
eMudhra generated the private keys of eight of its intermediate CA certificates incorrectly, so anyone can recover them from the public certificates. Six of the intermediates issue TLS certificates (EM DV, OV and EV TLS CA - G3B and G3C). The other two issue code-signing certificates.
Each intermediate exists twice: signed by an eMudhra emSign root, and cross-signed by Sectigo’s AAA Certificate Services. In a JDK cacerts, the chains end at one of two roots: emSign ECC Root CA - G3 (through a cross-sign) or AAA Certificate Services.
Compromised certificates are removed in this release of Liberica JDK.
Discontinued OS support
Note that Liberica JDK 27.0.1.0.2 is not available for and cannot be run on the following operating systems:
-
Windows x86 (32-bit)
-
macOS 10.x
IANA TZ Data version
This release of Liberica JDK 27.0.1.0.2 comes with the 2026e version of the in-tree copy of the Time Zone Database. The following are the key features of this version.
Briefly
Manitoba moves to permanent -05 on 2026-10-31.
Changes to future timestamps
Manitoba’s 2026-03-08 spring forward was its last foreseeable clock change, as it moved to permanent -05 thereafter. Model this with its traditional abbreviation EST. Although the change to permanent -05 legally takes place on 2026-10-31, temporarily model the change to occur on 2026-11-01 at 02:00 for the same reason as other recent temporary hacks. (Caution: see NOTE FOR 2026b TEMPORARY HACK FOR CLDR AND CANADA below.)
As the change affects both America/Winnipeg and its backward compatibility link, the obsolescent setting TZ="Canada/Central" will now use the abbreviation EST for affected timestamps, akin to TZ="Canada/Pacific" behavior introduced in 2026b.
Another TZDB release may be needed soon if any of the portions of northwestern Ontario historically aligned with America/Winnipeg do not follow. For now, given the short lead time with Manitoba’s announcement, assume that they will, to avoid creating new zones that may not be needed if no divergence occurs.
NOTE FOR 2026b TEMPORARY HACK FOR CLDR AND CANADA
This temporary hack works around a Canadian timekeeping bug in Unicode CLDR 48 and earlier. Unfortunately it also causes zic 2023d through 2026a, in the default slim mode, to generate a TZif file that does not conform to Internet RFC 9636 §3.3. The buggy file in turn causes some TZif readers, including tzcode itself, to ignore America/Vancouver’s 2026-11-01 02:00 transition from PDT (tm_isdst=1) to MST (tm_isdst=0). Although the buggy file does not cause any known TZif reader to mishandle UT offsets, caution is advised when using zic 2023d through 2026a to compile data from more-recent tz releases. To work around this problem when using these older zic versions, use ‘zic -b fat’.
Changes to past timestamps
In 1925 Ireland fell back on 09-20 not 10-04.
Changes to commentary
Discussion on timekeeping practices in northwestern Ontario has been expanded in light of Manitoba’s recent announcement. It is not yet known whether or to what extent these areas may adapt their own timekeeping practices in response.
For more information, see JDK-8393337.
3. Known Issues
This release does not contain any known issues.
4. Fixed CVEs
This is the list of the security issues fixed in this release. CVSS scores are provided using the CVSS version 3.1 scoring system.
| CVE ID | CVSS score | Component | Module | Attack Vector | Complexity | Privileges | User Interaction | Scope | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|---|---|---|---|---|---|
CVE-2026-91403 | 9.1 | security-libs | java.security | network | low | none | none | unchanged | high | high | none |
5. Resolved Issues
JDK issues
This is the list of general JDK issues fixed in this release.
| Issue ID | Summary |
|---|---|
JDK-8395142 | CA Enhancements |
6. Updates to Third Party Libraries
This release does not contain any changes in the third party libraries.
7. Upgrading to the New Version
To keep your Liberica JDK up-to-date and secure, always upgrade to the newest available version once it is released. To upgrade, install the new version over the previous one. For the installation instructions, see Liberica JDK Installation Guide.