Liberica JDK 8u502+9: Release Notes
Published: July 21, 2026
1. Version information
This document provides information about Liberica JDK 8u502 release. The full version string for this update release is 8u502+9. The version number is 8.
Liberica JDK 8 is distributed as .apk, .rpm, .zip, .deb, .pkg, and .tar.gz packages. Please select the most appropriate for your purposes.
2. What’s New
This release contains the following updates and new features.
Notable Changes
This is the list of the notable issues fixed in this release.
| Issue ID | |
|---|---|
JDK-8372351 | Summary: Added WISeKey Global GB and GC Root CA Certificates Description: wisekeyglobalrootgbca and wisekeyglobalrootgcca root certificates have been added to the |
IANA TZ Data version
This release of Liberica JDK 8u502 comes with the 2026b version of the in-tree copy of the IANA timezone database. The following are the key features of this version.
Briefly
British Columbia moved to permanent -07 on 2026-03-09.
Some more overflow bugs have been fixed in zic.
Changes to future timestamps
British Columbia’s 2026-03-08 spring forward was its last foreseeable clock change, as it moved to permanent -07 thereafter. (Thanks to Arthur David Olson.) Although the change to permanent -07 legally took place on 2026-03-09, temporarily model the change to occur on 2026-11-01 at 02:00 instead. This works around a limitation in CLDR v48.2 (2026-03-17). This temporary hack is planned to be removed after CLDR is fixed.
Changes to code
-
zic no longer mishandles a last transition to a new time type.
-
zic no longer overflows a buffer when generating a TZ string like "PST-167:59:58PDT-167:59:59,M11.5.6/-167:59:59,M12.5.6/-167:59:59", which can occur with adversarial input. (Thanks to Naveed Khan.)
-
zic no longer generates a longer TZif file than necessary when an earlier time zone abbreviation is a suffix of a later one. As a nice side effect, zic no longer overflows a buffer when given a long series of abbreviations, each a suffix of the next. (Buffer overflow reported by Arthur Chan.)
-
zic no longer overflows an int when processing input like ‘Zone Ouch 2147483648:00:00 - LMT’. The int overflow can lead to buffer overflow in adversarial cases. (Thanks to Naveed Khan.)
-
zic now checks for signals more often.
For more information, see JDK-8383175.
3. Known Issues
This release does not contain any known issues.
4. Fixed CVEs
This is the list of the security issues fixed in this release. CVSS scores are provided using the CVSS version 3.1 scoring system.
| CVE ID | CVSS score | Component | Module | Attack Vector | Complexity | Privileges | User Interaction | Scope | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|---|---|---|---|---|---|
CVE-2026-41254 | 7.5 | client-libs | 2d | network | low | none | none | unchanged | none | none | high |
CVE-2026-46968 | 5.9 | security-libs | javax.net.ssl | network | high | none | none | unchanged | none | high | none |
CVE-2026-47010 | 3.7 | client-libs | javax.imageio | network | high | none | none | unchanged | none | low | none |
CVE-2026-47013 | 5.3 | javafx | graphics | network | low | none | none | unchanged | none | none | low |
CVE-2026-47021 | 5.3 | client-libs | 2d | network | low | none | none | unchanged | none | none | low |
CVE-2026-47027 | 5.3 | security-libs | java.security | network | low | none | none | unchanged | none | none | low |
CVE-2026-47030 | 3.1 | javafx | web | network | high | none | required | unchanged | none | low | none |
CVE-2026-47034 | 3.1 | javafx | media | network | high | none | required | unchanged | none | low | none |
CVE-2026-47035 | 3.1 | javafx | media | network | high | none | required | unchanged | none | low | none |
CVE-2026-47057 | 7.5 | core-libs | javax.script | network | low | none | none | unchanged | none | none | high |
CVE-2026-47058 | 7.4 | core-libs | javax.script | network | high | none | none | unchanged | high | high | none |
CVE-2026-47059 | 5.9 | client-libs | 2d | network | high | none | none | unchanged | none | none | low |
CVE-2026-47063 | 7.5 | security-libs | java.security | network | low | none | none | unchanged | none | high | none |
CVE-2026-60147 | 6.5 | security-libs | java.security | network | low | none | none | unchanged | low | low | none |
CVE-2026-60164 | 3.1 | javafx | web | network | high | none | required | unchanged | low | none | none |
CVE-2026-60165 | 3.1 | javafx | media | network | high | none | required | unchanged | none | low | none |
CVE-2026-60166 | 3.1 | javafx | media | network | high | none | required | unchanged | low | none | none |
5. Resolved Issues
JDK issues
This is the list of general JDK issues fixed in this release.
| Issue ID | Summary |
|---|---|
JDK-6815126 | intermittent SimulResumerTest.java failure |
JDK-8162545 | Mac build failure |
JDK-8199138 | Add RISC-V support to Zero |
JDK-8209362 | sun/security/ssl/SSLSocketImpl/ReuseAddr.java failed due to "BindException: Address already in use (Bind failed)" |
JDK-8246330 | Add TLS Tests for Legacy ECDSA curves |
JDK-8249159 | Downport test rework for SSLSocketTemplate from 8224650 |
JDK-8261235 | C1 compilation fails with assert(res→vreg_number() == index) failed: conversion check |
JDK-8273135 | java/awt/color/ICC_ColorSpace/MTTransformReplacedProfile.java crashes in liblcms.dylib with NULLSeek+0x7 |
JDK-8274736 | Concurrent read/close of SSLSockets causes SSLSessions to be invalidated unnecessarily |
JDK-8280158 | New test from JDK-8274736 failed with/without patch in JDK11u |
JDK-8298873 | Update IllegalRecordVersion.java for changes to TLS implementation |
JDK-8301189 | validate-source fails after JDK-8298873 |
JDK-8314730 | [GHA] Drop libfreetype6-dev transitional package in favor of libfreetype-dev |
JDK-8321489 | Update LCMS to 2.16 |
JDK-8336451 | [11u] GHA macos-13 and macos-15 builders are unable to resolve local hostname |
JDK-8339271 | giflib attribution correction |
JDK-8343622 | AesDkCrypto.stringToKey should not return null |
JDK-8345578 | New test in JDK-8343622 fails with a promoted build |
JDK-8348110 | Update LCMS to 2.17 |
JDK-8351359 | OperatingSystemMXBean: values from getCpuLoad and getProcessCpuLoad are stale after 24.8 days (Windows) |
JDK-8363966 | [GHA] Switch cross-compiling sysroots to Debian trixie |
JDK-8368041 | Enhance TLS certificate handling |
JDK-8369996 | Testcase java/net/Socket/B8312065.java fails on Mac, AIX and Solaris |
JDK-8372351 | Add 2 WISeKey roots |
JDK-8374058 | Enhance JPEG handling |
JDK-8374888 | Implement internal test cache to help UserIterCount test performance |
JDK-8375065 | Update LCMS to 2.18 |
JDK-8377158 | Enhance XBM image support |
JDK-8377498 | Improve HttpServer handling |
JDK-8377833 | Enhance Jar file processing |
JDK-8378631 | Update Zlib Data Compression Library to Version 1.3.2 |
JDK-8378687 | Improve delegation of HttpURLConnection |
JDK-8379256 | Update GIFlib to 6.1.1 |
JDK-8379684 | Bump update version of OpenJDK: 8u502 |
JDK-8380078 | Update GIFlib to 6.1.2 |
JDK-8380377 | [8u] Problem list CAInterop.java#teliarootcav2 |
JDK-8380672 | Improve certification checking |
JDK-8380689 | distrust/Chunghwa.java test fails with a compilation error |
JDK-8380947 | Add pull request template |
JDK-8380959 | Update Libpng to 1.6.56 |
JDK-8381039 | Enhance AWT ImagingLib |
JDK-8381049 | Enhance Jar handling |
JDK-8381185 | Improve Nashorn index handling |
JDK-8381195 | Enhance Dataview Implementation |
JDK-8381519 | Enhance Der Value Handling |
JDK-8381796 | Enhance Certificate parsing |
JDK-8382047 | Update Libpng to 1.6.57 |
JDK-8383175 | (tz) Update Timezone Data to 2026b |
JDK-8383354 | Update LCMS to 2.19.1 |
JDK-8383473 | Follow on from tzdata2026b time change to include temporary hack BC time change |
JDK-8384158 | [GHA] Downgrade Windows GHA runners to windows-2022 temporarily |
JFX issues
This is the list of JFX issues fixed in this release.
| Issue ID | Summary |
|---|---|
JDK-8313040 | Enhanced Font handling |
JDK-8313072 | Enhanced handling of Fonts |
JDK-8373527 | Improve Graphics playback |
JDK-8375084 | Update libxslt to 1.1.45 |
JDK-8378226 | Animated GIFs do not animate after WebKit 620.1 update |
JDK-8378277 | Improve Editor selection |
JDK-8379206 | 4 Null pointer dereference defect groups in 4 glib files |
JDK-8379207 | Improve audio conversion |
JDK-8379209 | Uninitialised variable in pathApplierFunctionFast of coretext.c |
JDK-8379211 | Uninitialised memory in Java_com_sun_javafx_font_freetype_OSFreetype_FT_1Outline_1Decompose |
JDK-8379257 | Update JPEG Image Decoding Software to 10 |
JDK-8379336 | Update libxml2 to 2.15.2 |
JDK-8381447 | Remove G_DISABLE_CHECKS compiler flag on Windows to align GLib/GStreamer compilation with macOS/Linux |
JDK-8383092 | Enhance WebView Resource Loading |
JDK-8383143 | Enhance Playlist Loading |
6. Updates to Third Party Libraries
This is the list of changes in the third party libraries.
| Library | Full name | New Version | Module | JBS number |
|---|---|---|---|---|
GIFlib | GIFlib | 6.1.2 | java.desktop | JDK-8380078 |
LCMS | LittleCMS | 2.19.1 | java.desktop | JDK-8383354 |
libjpeg | JPEG Image Decoding Software | 10 | javafx.web | JDK-8379257 |
Libpng | Libpng | 1.6.57 | java.awt | JDK-8382047 |
libxml2 | libxml2 | 2.15.2 | javafx.web | JDK-8379336 |
libxslt | libexslt | 1.1.45 | javafx.web | JDK-8375084 |
Zlib | Zlib | 1.3.2 | java.desktop | JDK-8378631 |
7. Upgrading to the New Version
To keep your Liberica JDK up-to-date and secure, always upgrade to the newest available version once it is released. To upgrade, install the new version over the previous one. For the installation instructions, see Liberica JDK Installation Guide.