What changed
Amazon released critical security patch updates for Amazon Corretto on August 18, 2026. The update covers all supported Long-Term Support (LTS) and Feature Release (FR) versions of Corretto, Amazon's no-cost distribution of OpenJDK, the open-source Java Development Kit.
The patched versions are Corretto 26.0.2.11.1, 25.0.4.8.1, 21.0.12.9.1, 17.0.20.10.1, 11.0.32.10.1, and 8u504. Amazon labels this a Critical Security Patch Update (CSPU), a release outside the regular quarterly cycle. Amazon has stated it plans to apply urgent fixes, including security patches, outside that cycle when they are available and ready to use.
The July 2026 quarterly update had shipped the previous versions of those same branches on July 22. Those builds, the six July quarterly releases, were the versions in place before this August patch.
Release details
This patch carries the CSPU designation, which Amazon applies when a security fix is urgent enough to bypass the planned quarterly schedule. Updates are planned quarterly, but Amazon also commits to applying urgent fixes outside that cycle when the fixes are ready.
The August 18 patch increments each branch beyond the July 22 quarterly build. The July releases carried base version numbers such as 26.0.2 and 25.0.4. The August CSPU builds carry additional patch identifiers: 26.0.2.11.1 and 25.0.4.8.1, for example.
Amazon provides Corretto at no cost under the GNU Public License version 2 with the Classpath Exception (GPLv2 with CPE). There are no additional paid features or restrictions on its use.
Availability and support calendars
All six patched versions are available for download at the Corretto home page. Linux users can also receive the updates by configuring a Corretto Apt, Yum, or Apk repository.
The support calendars for the affected versions differ by release type. Corretto 26 is a Feature Release with an end-of-life date of October 2026. The five remaining versions are LTS releases with longer commitments. Corretto 25 runs through October 2032. Corretto 21 runs through October 2030, and Corretto 17 through October 2029. Corretto 11 runs through January 2032, and Corretto 8 through December 2030.
Amazon runs Corretto internally on thousands of production services and certifies each build against the Java SE standard using the Java Technology Compatibility Kit (TCK). Corretto is designed as a drop-in replacement for many Java SE distributions, and the FAQ confirms that existing command-line options, tuning parameters, and monitoring continue to work after installation.
Platform support varies by version. Corretto 8, 11, and 17 each support Linux with glibc and musl-libc, Windows 10 or later and Server 2016, Server 2019, Server 2022, and Server 2025, and macOS 14 (Sonoma) or later on x64 and aarch64. Installation guides for Linux, Windows, macOS, and Docker are available for all six versions.
Feedback on the release can be submitted through the Corretto GitHub repository.
Related service: Software and Systems Modernization