JDK 27 GA: Post-Quantum Security and G1 GC Defaults Lead New Release
The September 2026 release introduces nine JEPs, prioritizing quantum-resistant encryption and standardized memory management.
JDK 27, the reference implementation of Java 27, reached General Availability (GA) in September 2026. This release marks a strategic update to the JVM ecosystem, prioritizing security hardening and memory management efficiency to reduce manual developer configuration.
According to an official OpenJDK announcement, the GA version is based on Build 35, which previously served as the second Release Candidate. Mark of OpenJDK Announce confirmed that Build 35 is now the production-ready GA build. The release delivers nine JDK Enhancement Proposals (JEPs) that refine the language and its underlying runtime.
Technical Enhancements
The update introduces a suite of technical improvements across several domains. Key additions include the Vector API (JEP 537), Structured Concurrency (JEP 533), and Primitive Types in Patterns (JEP 532). The release also implements Lazy Constants (JEP 531), PEM Encodings (JEP 538), and JFR In-Process Data Redaction (JEP 536). To optimize memory footprints, the release enables Compact Object Headers by Default (JEP 534).
Performance and Security Shifts
Two of the most impactful changes in JDK 27 concern the platform's defaults. The G1 garbage collector is now the default GC across all environments (JEP 523), a move intended to standardize performance profiles and simplify tuning for production environments.
On the security front, the release introduces Post-Quantum Hybrid Key Exchange for TLS 1.3 (JEP 527). This prepares the JVM for a future where quantum computing could threaten traditional encryption standards, ensuring Java applications remain compliant with evolving cybersecurity requirements for encrypted traffic.
These shifts reflect Java's rapid release cadence, which delivers new versions every six months. This cycle allows the community to iterate on features through 'Preview' and 'Incubator' stages before they are finalized, ensuring that high-impact changes like post-quantum cryptography are thoroughly vetted before wide deployment.
Industry Implications
The transition to G1 as the universal default GC removes a significant layer of complexity for many enterprise environments. More critically, the integration of post-quantum security standards signals a move toward a more resilient runtime. By baking these standards into the platform, Oracle and the OpenJDK community are reducing the burden on developers to implement complex security patches manually.
Looking Ahead
As developers migrate to JDK 27, the industry will focus on the real-world performance gains of the new GC defaults and the adoption of the Vector API. While the core technical specifications are now finalized, the primary interest will be how these enhancements influence the next Long-Term Support (LTS) cycle and whether post-quantum implementations become the new baseline for enterprise security.