Azul has released updated builds of OpenJDK to block eight compromised eMudhra certificate authority certificates, warning that Java runtimes don’t check certificate revocation by default and could otherwise trust forged websites.
The compromise of eight eMudhra intermediate CA certificates became public on 20 October 2026. eMudhra found, and Mozilla and Google’s Chrome Root Program confirmed, that the private keys behind the certificates were generated defectively — meaning anyone could derive them from the public certificates and impersonate services that trust the affected chain. eMudhra has revoked the certificates, and Apple, Google, Microsoft and Mozilla have blocked them in their browsers and operating systems. eMudhra says only one of the eight intermediates was ever used in production and that none issued an end-entity certificate, and Google reports finding no certificates chaining to them in its Certificate Transparency logs.
Why Java needed its own fix
Azul, which describes itself as a leader in enterprise Java, says the compromised intermediates chain to roots that many OpenJDK distributions trust — so an unpatched JDK could still accept a forged certificate even after browsers have blocked it. Within 24 hours of the public disclosure, Azul published a workaround and released tested builds of Azul Zulu for Java 27, 25, 21, 17, 11, 8, 7 and 6, and Azul Prime for Java 25, 21, 17, 11 and 8, each adding the eight certificates to the JDK’s blocked list. No manual changes are needed after installing the update.
Azul delivered the fix as what it calls a “Security-only, Stability-first” update, built on the prior release cycle with only security fixes added, which it says carries a lower risk of regression than a full version upgrade. The out-of-cycle update shipped on 21 October 2026, a day after Mozilla and Chrome’s Root Program confirmed the compromise and before any CVE had been assigned to it.
Azul says it powers Java systems for 37% of the Fortune 100 and 50% of Forbes’ Top 10 World’s Most Valuable Brands. The company is advising enterprises running Java to confirm which of their systems still trust the compromised certificates and apply the update, rather than rely on manual workarounds across large fleets of installations.
