EOL OpenJDK Security Patches — Versions 7, 8, 11, 17

Check the status of CVEs. Learn More.

 CVE Status (opens in new tab)

php2shell patches (CVE-2026-109618 and CVE-2026-109619) for EOL PHP are out now. With sales replies slower than usual due to high demand, the fastest route to patched packages is to buy ELS for Runtimes online (opens in new tab). Read the patch FAQ

Drop-in Continuity

Maintain operational continuity and avoid downtime without OpenJDK
reinstallation – just swap your update repositories.

OpenJDK versions follow a fixed support cadence. Once they
reach end of life, the OpenJDK community stops providing
security fixes – leaving your systems exposed.

Upgrading to the next OpenJDK version can cause breaking changes, which can derail established CI/CD pipelines and production workflows.

With Endless Lifecycle Support (ELS) for OpenJDK, you can keep your systems running smoothly and avoid
large-scale code rewrites while using your existing versions of OpenJDK for years to come.

What Does Endless Lifecycle
Support Include?

Rapid CVE Response

Rapid SLA-backed security patches for OpenJDK for as long as you need

Preserved Compatibility

Extensively tested updates designed to work flawlessly with your existing code

Seamless Integration

Drop-in OpenJDK security updates with no disruption to existing workflows

Secure Distribution

Signed, tamper-proof OpenJDK security updates delivered from trusted, TuxCare-hosted repositories

Trusted Support

24/7 expert assistance with OpenJDK vulnerability triage, security patch requests, and troubleshooting

We Keep Your OpenJDK Secure on
Various Versions of Enterprise Linux
and Debian-Based Systems

  • Red Hat
    Enterprise Linux
  • CentOS
  • AlmaLinux
  • Rocky Linux
  • Oracle Linux
  • Debian
  • Ubuntu

How Does It Work?

1

We onboard new projects and enable 24/7 automated CVE tracking – monitoring the NVD, vendor, and GitHub security advisories, and other sources.

2

Once CVEs are detected, we backport upstream fixes using algorithmic and AI-assisted automation, with expert validation to ensure accuracy.

3

Patches are compiled in a binary format, extensively tested (for integrity, functionality, and regression), signed, and deployed to ELS repositories.

4

Your package managers, build tools, or orchestrators check for updates, then automatically pull and install them.

Learn More

If It’s Open Source
and Not on Our List,

We’re Ready to
Support It. Just Ask.

Tell Us What You Need

We’ve Been Powering Enterprise-Grade Patching At
Unprecedented Scale – and We're Just Getting Started

2,700+
Enterprise Clients

70,000+Packages Curated

420,000+
Patches Delivered

14,000+
Vulnerabilities Fixed

11,000+
Kernels Supported

70+
Linux Distro Versions Supported

Why TuxCare?

15 years of proven excellence in open-source patching have created highly
automated processes and systems, providing:

Extensive Coverage of Open-Source Technologies

We provide long-term security across your entire stack, supporting a wide and continually expanding set of open-source projects, libraries, and runtimes – all from a single, trusted partner.

Efficiencies in Build Chains and Testing

We utilize advanced automation across CVE discovery, backporting, building, and release workflows to accelerate delivery and ensure the highest possible quality of security patches.

Identification and Patching of Transitive Dependencies

We go beyond surface-level scanning to uncover and fix hidden vulnerabilities deep in your dependency trees, securing the entire software supply chain with precision and scale.

Fast and Consistent Delivery of Patches with Supporting SLAs

Automated pipelines and mature workflows ensure rapid, reliable patch delivery backed by SLAs – giving you confidence in your risk management and compliance posture.

Frequently Asked Questions

It depends entirely on your build. Oracle's free public updates for Java 7 and 8 ended years ago, most vendors now gate older JDK lines behind paid subscriptions, and distro-packaged OpenJDK inherits your OS lifecycle — so an EOL operating system usually means an unpatched JDK. ELS supplies patched OpenJDK builds independent of your OS vendor's schedule.

OpenJDK 7, 8, 11, and 17 as RPMs across EL 6, EL 7, EL 8, and EL 9 — CentOS, CentOS Stream, CloudLinux, Oracle Linux, RHEL, and AlmaLinux — on x86_64. Other versions and architectures are available on request.

No. Fixes are backported into the same OpenJDK version you already run, so bytecode compatibility, JVM flags, GC behavior, and vendor-specific tuning all hold. You skip the regression cycle a major JDK jump forces.

Sometimes that's the right call — but Java 8 to 17 crosses the module system, removed internal APIs, and reflective-access restrictions, and routinely breaks application servers, agents, and older frameworks. ELS keeps you patched while you sequence that work properly.

Through your existing package manager. You run TuxCare's installer script with an ELS license key to register the repository, then install and update OpenJDK with standard yum commands. No new tooling, no agent, and the packages are Docker compatible for containerized workloads.

Critical, high, medium, and low-risk CVEs, scored against both NVD and vendor CVSS ratings with the higher score taking precedence. Target delivery is 14 days from disclosure for CVSS 7.0+, 60 days for medium, and 90 days for low.

Talk to a TuxCare Expert

Tell us your challenges, and our experts will help you find the best approach to address
them with the TuxCare product line.

Ask Us a Question