Oracle Releases Java 27 With Major Post-Quantum Cryptography Upgrade

Oracle has released Java 27, the latest version of its widely used programming language and development platform, with significant upgrades to security, performance and artificial-intelligence workloads.

Released on September 15, 2026, Java 27 introduces nine JDK Enhancement Proposals (JEPs), including a major addition aimed at preparing Java applications for future quantum-computing threats.

One of the most significant security changes is JEP 527: Post-Quantum Hybrid Key Exchange for TLS 1.3.

The feature combines traditional cryptographic algorithms with quantum-resistant algorithms when establishing secure TLS 1.3 connections. The approach is designed to protect sensitive communications against future quantum computers while allowing organisations to transition without immediately abandoning established cryptographic systems.

Java 27 supports three hybrid key-exchange algorithms: X25519MLKEM768, SecP256r1MLKEM768 and SecP384r1MLKEM1024. The X25519MLKEM768 combination is placed first in the default list of supported groups. Oracle has also strengthened Java’s broader post-quantum cryptography foundation with updated ML-KEM and ML-DSA private-key encodings and performance improvements for ML-KEM, ML-DSA, X25519 and Ed25519.

The security changes are intended to address the so-called “harvest now, decrypt later” threat, in which encrypted information intercepted today could potentially be decrypted in the future if sufficiently powerful quantum computers become available.

Oracle says the company is also working to bring comparable post-quantum capabilities to supported Long-Term Support versions of Java. JDK 25 is expected to reach functional parity with Java 27’s PQC capabilities through its October 2026 update, while JDK 21 and 17 are targeted for the first half of 2027.

Java 27 also introduces changes intended to improve application performance and efficiency. Among them is compact object headers by default, which reduces object headers from 96 bits to 64 bits on 64-bit systems. The change can reduce memory usage and improve application density.

The release also makes the G1 garbage collector the default across environments, while the Vector API continues to evolve for workloads involving analytics, scientific computing and AI. Structured Concurrency is also included as a preview feature.

Oracle is positioning these improvements as particularly relevant to cloud, microservices, data-intensive and AI-enabled applications.

Java 27 follows Oracle’s six-month release schedule and is the 18th feature release delivered under that cadence. It will receive updates until March 2027, when it is scheduled to be superseded by Java 28. Java 25 remains the latest Long-Term Support (LTS) release for organisations seeking a longer support cycle.

With Java 27, Oracle is therefore combining conventional improvements to Java’s performance and developer experience with a broader effort to prepare enterprise software for the security challenges expected from future quantum computing.