Java 27 Advances Post-Quantum Security and Previews Future Language Features

Java 27 combines security work with an evolving platform roadmap

Oracle has released Java 27, a non-LTS update to the Java language and virtual machine that contains nine JEPs. The release combines production-oriented platform changes with a substantial set of preview and incubator features. Its direction is clear: strengthen the security foundation of Java deployments while keeping work on future language and runtime capabilities moving through public iteration.

A prominent element is post-quantum cryptography. Java 27 adds hybrid key exchange support for TLS 1.3, building on a quantum-resistant module-lattice-based key encapsulation mechanism that arrived in JDK 24. The TLS work is intended to enhance the existing TLS 1.3 implementation through a hybrid approach specified in an Internet Engineering Task Force draft. It forms part of a broader Oracle roadmap to make standardized post-quantum algorithms and PQC-enabled TLS available across the Java ecosystem and current long-term support releases.

Cryptographic object handling also remains in preview. The PEM encoding API is back for a third preview, providing a route to encode and decode cryptographic keys, certificates and certificate revocation lists using the widely used PEM transport format. It supports conversion between PEM text and objects represented in PKCS #8 and X.509 binary forms. The latest iteration changes the PEM record into a regular class, making constructors for Base64 byte-array content available, and renames an interface from DEREncodable to BinaryEncodable to better reflect the binary data held in PEM text.

Beyond security, Java 27 continues experimentation in core language and programming-model areas. Lazy constants, primitive types in patterns, instanceof and switch, and structured concurrency all receive further preview rounds. The Vector API enters its twelfth incubator cycle, without substantial implementation changes since JDK 25. Its purpose is to let developers express vector operations that can be compiled at runtime into suitable vector instructions on supported processor architectures.

Runtime and operational changes include making the G1 garbage collector the default in all environments, enabling compact object headers by default, and adding in-process data redaction for Java Flight Recorder. These additions sit alongside the release's preview and incubator work, illustrating that Java 27 is not limited to one layer of the platform.

The release also expands the Java Verified Portfolio, Oracle's ecosystem of supported technologies. Helidon 27 adopts OpenJDK-aligned versioning and begins a Tip & Tail library-development model: Helidon 27 acts as the faster-moving Tip, while Helidon 4.5.5 remains the longer-lived Tail for teams that need a production baseline. JavaFX 27 adds a Metal rendering pipeline for macOS, text-editing enhancements and further accessibility improvements. Oracle Jipher 20 broadens JDK-version support and supports the newly described security capabilities.

Attention is already turning to JDK 28, expected in March 2027. Targeted work includes preview features from Project Valhalla, notably strict field initialization in the JVM and value classes and objects. Java 27 is available from Oracle, with binaries from other vendors expected to follow.