Java 27: What’s New and How to Install JDK 27

JDK 27 reached general availability on 15 September 2026 with nine JEPs. Here is how to install the GA build on Linux and prove each headline change — G1 everywhere, compact object headers, post-quantum TLS — on your own machine.

What you will have at the end

A JDK 27 you can switch to and back from, a version string you can paste into a bug report, and one command per feature proving the new defaults are live.

Prerequisites

• Linux x64 — the GA builds also cover Linux AArch64, macOS AArch64 and Windows x64
• About 230 MB for the download and 500 MB of free disk
• curl, tar and sha256sum
• An existing JDK to fall back to; JDK 25 is the current LTS

1. Check what you already have

Print the JDK version on your PATH before changing anything — Oracle’s bug-reporting guidance asks for exactly this output.

java --version

2. Download the GA build

OpenJDK publishes production-ready JDK 27 build 35 binaries under the GPL with the Classpath Exception. The Linux x64 tarball is 226,435,531 bytes.

curl -LO https://download.java.net/java/GA/jdk27/55ce5470a6294008af0057ff4626d0e5/35/GPL/openjdk-27_linux-x64_bin.tar.gz

Fetch the published checksum beside it.

curl -LO https://download.java.net/java/GA/jdk27/55ce5470a6294008af0057ff4626d0e5/35/GPL/openjdk-27_linux-x64_bin.tar.gz.sha256

3. Verify the download

The published digest for this build is 95fc37eb3a18a27a26d5904c2d89d52bace8dafa9a078ca27f4747fbc4bf070b. That file holds the hash alone, without a filename, so sha256sum -c cannot consume it — compute the hash and compare by eye.

sha256sum openjdk-27_linux-x64_bin.tar.gz

4. Install it side by side

Extract into /opt, leaving your working JDK untouched so a rollback is one environment change.

sudo tar -xzf openjdk-27_linux-x64_bin.tar.gz -C /opt

The archive unpacks into a versioned directory; that path is what JAVA_HOME points at.

export JAVA_HOME=/opt/jdk-27

Put it in front of the older JDK on the PATH.

export PATH="$JAVA_HOME/bin:$PATH"

Confirm the shell resolves to 27.

java --version

5. Prove the new defaults are live

JEP 523 makes G1 the default collector in every environment, not only server ones. Until now the JVM chose Serial on a single CPU or under 1792 MB of RAM, and G1 has since caught up on throughput and footprint at every heap size. The unified GC log names the collector the JVM selected.

java -Xlog:gc -version

An explicit choice still overrides the default, so Serial stays one flag away.

java -XX:+UseSerialGC -Xlog:gc -version

JEP 534 enables compact object headers, cutting a header from 96 bits to 64 on 64-bit architectures; Oracle measures SPECjbb2015 at 22% less heap, 8% less CPU time and 15% fewer collections. Switch the layout off if a profiler or agent misbehaves on it.

java -XX:-UseCompactObjectHeaders -version

6. Post-quantum TLS 1.3 is on by default

JEP 527 adds three hybrid key-exchange schemes that pair ML-KEM with elliptic-curve Diffie-Hellman. Code on javax.net.ssl gets them unchanged: X25519MLKEM768 now leads the default group list, and clients offer its key share alongside x25519. SecP256r1MLKEM768 and SecP384r1MLKEM1024 stay opt-in — reorder the list with a system property.

java -Djdk.tls.namedGroups=X25519MLKEM768,x25519,secp256r1 -jar application.jar

The same list is settable per socket from Java with SSLParameters.setNamedGroups. ffdhe6144 and ffdhe8192 left the defaults, and zlib certificate compression (RFC 8879) arrives enabled.

java -Djdk.tls.client.disableExtensions=compress_certificate -jar application.jar

7. Stop JFR writing your secrets to disk

Flight Recorder recorded command-line arguments, environment variables and system properties verbatim — tokens and passwords included — in every recording you shared. JEP 536 redacts them inside the process, by default and with no configuration. Add filters of your own:

java -XX:FlightRecorderOptions:'redact-key=confidential,redact-argument=https://*:*@*' -XX:StartFlightRecording:filename=dump.jfr -jar application.jar

redact-key matches an environment variable or system property key; redact-argument matches a command-line argument, and a trailing * absorbs the next argument too. Turn the defaults off when you need the raw values:

java -XX:FlightRecorderOptions:redact-key=none,redact-argument=none -XX:StartFlightRecording:filename=dump.jfr -jar application.jar

Read the recording back and redaction shows as [REDACTED] in the event values.

jfr print --events InitialSystemProperty,JVMInformation,StringFlag,InitialEnvironmentVariable dump.jfr

When a filter does not match what you expected, ask the JVM which arguments it redacted.

java -Xlog:jfr+redact=debug -XX:StartFlightRecording:filename=dump.jfr -jar application.jar

8. Opt into the previews

Four JEPs are preview work — lazy constants (531), primitive types in patterns, instanceof and switch (532), structured concurrency (533) and PEM encodings of cryptographic objects (538) — while the Vector API (537) incubates. Join them from the compiler.

javac --enable-preview --release 27 LazyDemo.java

Daily commands

• java --version prints the version to stdout; java -version writes it to stderr
• javac --release 27 App.java compiles against the Java 27 API
• java -Xlog:gc:gc.log -jar app.jar sends the GC log to a file
• java -XX:+UseSerialGC -jar app.jar pins the collector back to Serial
• jfr print --events JVMInformation dump.jfr inspects a recording

Updating and rolling back

JDK 27 is a feature release, not an LTS: Oracle states it receives updates until March 2027, when JDK 28 supersedes it, and that its binaries are free in production under the No-Fee Terms and Conditions. For a long support window, JDK 25 is the current LTS.

Because you installed side by side, rolling back means repointing two variables and taking a 27.x update means unpacking a fresh archive beside the old tree. Exercise the new defaults on staging before moving a production service.

Troubleshooting

java –version still reports the old release

An older JDK earlier in the PATH wins. Run which -a java to see every match and re-order the PATH.

Heap behaviour changed after the upgrade

G1’s -XX:MinHeapFreeRatio and -XX:MaxHeapFreeRatio defaults moved from 40 and 70 to 0 and 100, effectively disabling resizing on those constraints, and -XX:InitiatingHeapOccupancyPercent is now -XX:G1IHOP.

A TLS peer refuses to negotiate

Name the groups with -Djdk.tls.namedGroups=…: the extra hybrids are opt-in and the two largest ffdhe groups are gone from the defaults.

JFR no longer shows the value you were looking for

That is redaction working. Re-run with redact-key=none,redact-argument=none, or narrow the filters and confirm the match with -Xlog:jfr+redact=debug.

Preview code compiles but will not run

Preview features must be enabled at run time too — a class compiled with --enable-preview will not start without the flag on the launcher.

Summary

JDK 27 is a defaults release: G1 everywhere, 64-bit object headers, post-quantum TLS 1.3 and JFR redaction, none of it needing an application change. Install it beside your LTS, prove the four defaults with -Xlog:gc, -XX:-UseCompactObjectHeaders, jdk.tls.namedGroups and jfr print, and weigh the non-LTS window before shipping to production.

Image credits: featured photo “Programming code on a monitor screen” by Myburgh Roux via Pexels, used under the Pexels License (free to use) — https://www.pexels.com/photo/programming-codes-screengrab-1102797/. Primary sources: the OpenJDK project page for JDK 27, the JDK 27 JEPs, the JDK 27 release notes and Oracle’s Java 27 tool documentation.