Java 26 ships with new cryptography API and HTTP/3 support
Oracle released JDK 26, the 17th consecutive feature release delivered under the six-month cadence the project adopted in 2018. The release includes ten JDK Enhancement Proposals spanning language changes, garbage collection improvements, cryptographic tooling, and network protocol support.
PEM encoding API targets cryptographic integration
JEP 524 introduces a second preview of a PEM encoding API for cryptographic objects. The API converts keys, certificates, and certificate revocation lists into Privacy-Enhanced Mail format and decodes them back into Java objects. The goal is to reduce manual encoding errors and improve interoperability with systems that already use PEM as a standard format for key material exchange.
Separately, JEP 500, titled “Prepare to Make Final Mean Final,” issues compiler warnings when deep reflection is used to mutate final fields. The change enforces what Oracle describes as Java’s “integrity by default” principle. A future release is expected to convert those warnings into hard restrictions.
Outside the JEPs, the release adds hybrid public key encryption support for streamlined secure encryption, post-quantum-ready JAR signing for supply chain integrity, and enhanced controls for cryptographic algorithms and legacy keystores.
HTTP/3 lands in the standard library
JEP 517 adds HTTP/3 support to the HTTP Client API. Applications can now interact with HTTP/3 servers with minimal code changes. The update targets microservices and API-driven workloads where lower network latency matters. The HTTP Client API already supported HTTP/1.1 and HTTP/2.
Garbage collector and startup improvements
JEP 522 reduces synchronization between application threads and the G1 garbage collector to improve throughput. The goal is to process more work per unit of time on the same hardware.
JEP 516, part of Project Leyden, extends ahead-of-time object caching to work with any garbage collector, including ZGC. It loads pre-initialized Java objects from a GC-agnostic cache format at startup. The JEP builds on earlier Project Leyden work aimed at reducing the gap between JVM cold-start time and peak performance.
Language and library previews
JEP 530 continues the fourth preview of primitive types in patterns, instanceof, and switch expressions. The change removes restrictions on how primitive types can be used in pattern matching constructs and adds tighter dominance checks to help the compiler catch a broader category of coding errors.
JEP 526 offers a second preview of lazy constants, an API for objects holding unmodifiable data that the JVM treats as true constants at runtime. Applications can defer initialization of these constants without losing the performance characteristics of a final field declaration.
JEP 525 marks the sixth preview of structured concurrency, an API that treats related tasks running in different threads as a single unit of work. The API is designed to reduce thread leaks and improve the reliability of cancellation and shutdown sequences in concurrent code.
JEP 529 continues the Vector API in its eleventh incubator iteration. The API expresses vector computations that compile to hardware vector instructions on supported CPU architectures, targeting data analytics and AI inference workloads.
Applet API removed
JEP 504 removes the Applet API, which was deprecated for removal in JDK 17. The removal reduces the platform surface area and eliminates code that had no browser execution path remaining.
Contribution data
Of the 2,535 JIRA issues marked fixed in JDK 26, Oracle engineers resolved 1,729. The remaining 806 came from contributors at organizations including Alibaba, ARM, Google, IBM, Microsoft, NVIDIA, Red Hat, and SAP, along with smaller firms and independent developers.
Oracle Java Verified Portfolio
Alongside the JDK release, Oracle launched the Oracle Java Verified Portfolio, a curated set of supported components that includes JavaFX commercial support, the Helidon microservices framework, and the Java Platform Extension for Visual Studio Code. Oracle is also restoring commercial support for JavaFX, which will cover all new Java versions and all versions under active long-term support. Support for JavaFX on JDK 8 extends through March 2028.
JDK 26 is a standard feature release, not a long-term support release. Oracle will provide updates until September 2026, when JDK 27 is scheduled to ship.