Oracle Releases Java 27 with Hybrid Post-Quantum Cryptography for TLS 1.3

Java 27 ships hybrid post-quantum key exchange for TLS 1.3

Oracle announced the general availability of Java 27 (Oracle JDK 27) on September 17, 2026, with post-quantum cryptography positioned as the central security focus of the release. The flagship update, JEP 527: Post-Quantum Hybrid Key Exchange for TLS 1.3, integrates hybrid key exchange natively into the javax.net.ssl APIs, combining classical key exchange with quantum-resistant key encapsulation mechanisms. Java 27 thus enables default quantum protection for network communications without requiring application code rewrites, defending TLS streams against the so-called "harvest now, decrypt later" threat model.

Oracle Jipher 20 adds FIPS-validated PQC algorithms to the Java Verified Portfolio

Alongside JEP 527, Oracle introduced Oracle Jipher 20, which is now included in the Oracle Java Verified Portfolio (JVP). Jipher 20 wraps a FIPS 140-3 validated OpenSSL cryptographic module supporting the NIST-standardized ML-KEM (Kyber) and ML-DSA (Dilithium) algorithms, bringing native post-quantum algorithm support into regulated enterprise environments. JEP 538, a third preview for PEM encodings of cryptographic objects, also debuts in the release to streamline management and interoperability of quantum-safe keys, certificates, and CRLs.

Performance, concurrency, and developer tooling updates round out the release

Beyond security, Java 27 incorporates performance and language optimizations, including JEP 534 (Compact Object Headers by Default) to reduce JVM heap footprints and JEP 523 (G1 Default Garbage Collector Across All Environments). The release also extends virtual threads, structured concurrency, foreign functions, and pattern matching coverage across nine JEPs. Helidon 27 ships in parallel with performance and observability improvements, and JavaFX 27 receives refreshed components, reinforcing concurrency and developer productivity alongside the cryptography changes.

LTS backport roadmap frames the enterprise migration path

Oracle positioned the Java 27 cryptography work as part of a staged migration plan, noting that the post-quantum capabilities will be backported to long-term support (LTS) Java distributions on its established roadmap. By placing hybrid PQC in a feature release first and reserving the LTS consolidation for later, Oracle is targeting enterprises that depend on LTS lines while still allowing earlier adopters to validate quantum-safe TLS, ML-KEM, and ML-DSA integrations in production testing.

Other developments

Separately, Yahoo Finance reported on September 17, 2026, that Oracle's backlog-to-revenue ratio is drawing renewed investor attention as a measure of underlying business momentum independent of recent stock price swings, framed against continued growth in Oracle's cloud infrastructure segment.