Java 27 is here, but it is not the kind of release that asks you to relearn the language or rewrite your application. Most of its important changes happen behind the scenes: Java can use memory more efficiently, choose a different strategy for cleaning unused objects, protect network connections against future attacks, and produce safer diagnostic recordings.
If terms such as JVM, garbage collector, or JEP are unfamiliar, do not worry. We will translate each one into practical consequences.
Released on September 15, 2026, Java 27 contains nine JEPs. It is a non-LTS release; Java 25 remains the latest Long-Term Support release. In simple terms, Java 27 is a useful release to test and learn from, while companies that prioritize years of vendor support may prefer to remain on Java 25.
Here are the seven changes that deserve your attention.
First, what exactly was updated?
“Java” can refer to three related things:
- The Java language is the syntax you write: classes, records,
if,switch, and so on. - The JDK is the development kit containing the compiler, command-line tools, libraries, and the runtime.
- The JVM is the virtual machine that executes compiled Java code and manages resources such as memory.
Java 27 changes all three, but its biggest improvements are in the JDK and JVM. A JEP, or JDK Enhancement Proposal, is the public design document for a significant JDK change.
Feature status is equally important:
- Final means the feature is supported as a normal part of the platform.
- Preview means developers can test the feature, but it may still change.
- Incubator means an experimental API is available for feedback and is even less settled.
1. G1 is now the default GC in every environment
Java creates objects in memory while processing work. When they are no longer needed, a garbage collector (GC) finds their memory and makes it available again—automatic housekeeping for the application.
Java has several collectors because workloads have different priorities. Serial GC can suit very small applications. G1, short for Garbage-First, divides memory into regions and cleans promising regions first, balancing throughput with predictable pauses.
G1 was already the normal choice on server-class machines. Java 27 removes the remaining environment-dependent selection: if you do not explicitly choose a collector, HotSpot uses G1 everywhere, including small machines and containers where Serial GC could previously be selected.
For a beginner, the practical message is simple: your code will continue to work, but its performance profile may change. A service might use CPU differently, pause for different amounts of time, or keep a different amount of memory available.
Before upgrading, record the collector used by the current deployment and compare it with Java 27 under a representative load:
java -XX:+PrintCommandLineFlags -version
The safest approach is to compare Java 27 with your current JDK under realistic traffic rather than assuming that a newer default is automatically better for every workload.
2. Smaller object headers become the default
An object contains more than your declared fields. The JVM attaches a header with internal runtime information. Imagine a package: your data is the product, while the header is the shipping label.
Compact Object Headers move from an optional capability to the default HotSpot object layout. On 64-bit architectures, that label can shrink from 96 bits to 64 bits.
The saving on one object is tiny. Across millions, it can mean a smaller heap, better use of the CPU cache, and less memory for the GC to scan. Applications creating many small objects benefit most.
Your source code does not need to change. Still, agents, profilers, JNI code, or libraries that assume an object layout should be tested with the Java 27 build you plan to deploy.
3. TLS 1.3 gets hybrid post-quantum key exchange
TLS is the security protocol behind HTTPS. A client and server first perform a handshake to agree on encryption keys. Today's techniques are safe against current computers, but future quantum computers could threaten some of them.
Java 27 adds hybrid TLS 1.3 groups that combine conventional elliptic-curve cryptography with the post-quantum ML-KEM algorithm.
The traditional algorithm protects traffic today; ML-KEM adds protection against future quantum attacks. This counters harvest now, decrypt later: recording encrypted traffic now to attack it years later.
Applications using Java's standard javax.net.ssl APIs can benefit automatically when the other side also supports the new negotiation. Most developers do not need to call a new method. Platform teams should still test load balancers, proxies, external security providers, and any tool that inspects TLS handshakes.
Java 27 also enables TLS 1.3 certificate compression with zlib by default, reducing the size of certificate chains exchanged during a handshake.
4. JFR redacts sensitive data before it leaves the process
Java Flight Recorder (JFR) is a flight recorder for a Java application. It collects low-overhead information about CPU, memory, threads, and garbage collection to explain slow or unstable behavior.
The problem is that diagnostic data can accidentally contain secrets. Java 27 addresses this by redacting sensitive command-line arguments, environment-variable values, and system-property values inside the running process, before the recording is written or streamed.
That is a meaningful improvement for commands such as:
java -Ddb.password=secret -Dapi.key=token -jar app.jar
Redaction is enabled by default and can be extended with application-specific filters. This reduces the chance that a password or API key ends up in a recording shared with another team. It is still better not to pass secrets on the command line at all. JFR redaction is a safety net, not a replacement for a secret manager.
5. The most exciting APIs are still not final
Java 27 continues several long-running experiments. Here is what they mean without the jargon:
- Structured Concurrency groups related tasks. If loading a profile and recent orders in parallel fails, the group can cancel and report them as one operation instead of leaving work behind.
-
Primitive types in patterns makes values such as
int,long, anddoublework more naturally with pattern matching andswitch. The long-term goal is fewer awkward differences between primitive values and objects. - Lazy Constants delay expensive initialization until a value is actually requested. A large lookup table, for example, does not need to slow application startup if no request ever uses it.
-
PEM encodings give Java a standard way to read and write the familiar
-----BEGIN CERTIFICATE-----format used for cryptographic keys and certificates. - The Vector API describes one operation over several numbers at once. The JIT can translate it into CPU instructions useful for images, scientific computing, and machine learning.
These features are worth exploring, but their status matters. Preview code requires explicit flags:
javac --enable-preview --release 27 Main.java
java --enable-preview Main
The flags prevent accidental dependence on unfinished features. Preview and incubating APIs can change or disappear, so use them in controlled projects unless your maintenance policy accepts that cost.
6. Production diagnostics get more useful
Production debugging requires inspecting the JVM that is actually running, not merely the expected configuration.
jcmd gains a command that prints the active security properties of a running JVM:
jcmd <pid> VM.security_properties
Here, <pid> is the operating-system process ID of the Java application. VM.info and fatal-error logs also report the number of open file descriptors. A file descriptor represents an open file, socket, or similar resource; leaking too many can cause the dreaded Too many open files failure.
One compatibility detail can break monitoring pipelines: numeric fields in JSON thread dumps, including thread IDs and the PID, are now JSON numbers rather than strings. The output declares "formatVersion": 2. If you parse these dumps, test the parser before rollout.
7. Migration includes removals and behavior changes
Every platform eventually removes obsolete behavior. Beginners can treat this section as a checklist for build and platform teams; most ordinary application code will not use these features directly.
Java 27 removes several pieces of accumulated legacy:
- The experimental JVMCI and bundled Graal JIT are gone. This does not mean the wider GraalVM project has disappeared.
- Several obsolete JVM verification and class-GC flags are removed.
- Linux's
VFORKprocess-launch mechanism is removed. -
ThreadPoolExecutor.finalize()is removed. -
HttpServerchanges from string-prefix matching to path-prefix matching. A context at/foomatches/foo/bar, but no longer/foobar. -
ServiceLoadernow consistently wraps linkage failures inServiceConfigurationError.
Build plugins, agents, platforms, and older libraries are more likely to depend on these details. Successful compilation alone does not prove an upgrade is safe.
A practical upgrade checklist
- Confirm your support policy. Java 27 is not LTS; decide whether you are evaluating, experimenting, or deploying.
- Inventory JVM flags. Search container images, deployment manifests, CI jobs, and startup scripts for removed or obsolete options.
- Benchmark with production-like traffic. Pay special attention to the G1 switch, heap behavior, startup, tail latency, and memory.
- Test infrastructure boundaries. Exercise TLS proxies, custom providers, monitoring agents, native integrations, and thread-dump parsers.
-
Separate final features from previews. Do not accidentally make
--enable-previewa hidden production dependency. - Run compatibility tools and the full test suite. Unit tests alone rarely expose runtime, packaging, and observability issues.
- Keep a rollback path. Record the JDK build, flags, images, and baseline metrics used by the previous deployment.
So, should you upgrade?
For most teams, Java 27 is best viewed as an evaluation release with unusually practical runtime improvements. G1 everywhere and Compact Object Headers can improve deployment behavior without source changes. Post-quantum TLS and JFR redaction make safe behavior the default. The preview APIs show where Java is heading, but they are not yet stable contracts.
If you are on Java 25 LTS, there is no need to move simply because 27 exists. Install it in CI, run your services under realistic load, and use what you learn to prepare for the next releases. If you already track every six-month release, Java 27 is a compelling upgrade—provided you test the defaults you did not explicitly choose.
The real story of Java 27 is not flashy syntax. It is a JVM that uses memory more efficiently, exposes safer diagnostics, and prepares network security for a very different future.
