Oracle Launches Java 27 Featuring Hybrid Post-Quantum Cryptography for TLS 1.3

Oracle (NYSE: ORCL) has announced the general availability of Java 27 (Oracle JDK 27), introducing significant security, runtime, and developer updates across the Java ecosystem. A central focus of the release is advancing enterprise post-quantum cryptography (PQC) readiness to protect global cloud, microservice, and enterprise applications against “harvest now, decrypt later” security threats.

Heading the security updates is JEP 527: Post-Quantum Hybrid Key Exchange for TLS 1.3, which integrates hybrid key exchange algorithms natively into the javax.net.ssl APIs. By combining classical key exchange with quantum-resistant key encapsulation mechanisms, Java 27 enables default quantum protection for network communications without requiring application code rewrites. Additionally, Oracle announced Oracle Jipher 20, now included in the Oracle Java Verified Portfolio (JVP), which wraps a FIPS 140-3 validated OpenSSL cryptographic module supporting NIST-standardized ML-KEM (Kyber) and ML-DSA (Dilithium) algorithms.

Beyond security enhancements, JDK 27 incorporates performance and language optimizations, including JEP 534 (Compact Object Headers by Default) to reduce JVM heap footprints and JEP 523 (G1 Default Garbage Collector Across All Environments). The updates establish a migration pathway as Oracle executes its roadmap to backport comparable PQC capabilities to long-term support (LTS) Java distributions.

Review the official release announcement via Oracle Newsroom here, inspect the technical breakdown on the Java Product Management Blog here, access developer resources on Dev.java here, and explore full platform documentation at Oracle Java here.

September 16, 2026