By Oracle’s free license for JDK 21 ends this month. Starting with the October 2026 Critical Patch Update, every security fix for Oracle JDK 21 requires either paying Oracle or moving to a different runtime. You have weeks — not months — to decide.
What’s Actually Changing
Oracle released JDK 21 in September 2023 under the No-Fee Terms and Conditions (NFTC) license. That license covers all updates through September 2026. The October 2026 CPU flips the switch: JDK 21 patches move to the same Oracle Java SE OTN license that already covers Java 8, 11, and 17.
Oracle is direct about it: “Users wanting to continue with permissively licensed versions of Java after October of 2026 should upgrade to Oracle JDK 25 or later.” This is not a surprise. It is the same playbook Oracle ran on every previous LTS — Java 8, 11, and 17 all followed this exact arc.
Option 1: Migrate to Oracle JDK 25
JDK 25 is the straightforward path for teams staying in the Oracle ecosystem. It shipped in September 2025, is free under NFTC until October 2028, and carries LTS support through 2033. The ecosystem already caught up — Spring Boot 3.5+, Gradle 9.1+, and Maven 3.14.1+ all support it.
Performance-wise, JDK 25 delivers 22% memory savings over JDK 21, faster startup, and virtual thread improvements that address real gaps from the JDK 21 release. For cloud and microservice workloads, that memory reduction translates directly into lower infrastructure spend.
The main breaking change to audit before upgrading: the Security Manager API is gone. It was deprecated in Java 17, disabled in Java 24, and now fully removed. Most modern applications dropped it years ago. Beyond that, the vast majority of JDK 21 applications compile and run on JDK 25 without code changes.
Option 2: Stay on JDK 21 and Pay Oracle
Oracle Java SE Universal Subscription keeps you on JDK 21 with commercial support through September 2031. The catch: pricing is employee-based, not install-based.
The tiers run from $15 per employee per month at 1–999 employees down to $5.25 per employee per month at 40,000–49,999 employees. “Employee” is defined broadly — all full-time, part-time, and temporary staff plus contractors and outsourcers supporting your operations. A company with 12,000 employees pays roughly $1.2 million per year at list price, whether it runs four JDK installs or four thousand.
This option makes sense for large enterprises with genuinely complex migrations and no near-term capacity to run them. For SMBs or any team that can reasonably move JDKs, the math rarely works in Oracle’s favor.
Option 3: Switch to a Free OpenJDK Distribution
The cleanest long-term answer for most teams is to cut Oracle out of the equation entirely. Three distributions cover the main use cases:
| Distribution | Best For | Cost |
|---|---|---|
| Eclipse Temurin | Vendor-neutral default | Free |
| Amazon Corretto | AWS stacks | Free |
| Azul Zulu | Paid support without Oracle | Free / Paid tiers |
Eclipse Temurin, maintained by the Eclipse Foundation’s Adoptium project, is the community standard. It is TCK-verified, backed by IBM, Google, Microsoft, and Alibaba, and tracks Oracle’s quarterly CPU schedule. Amazon Corretto is Amazon’s internal distribution — used on every Java service across Lambda, ECS, and EC2 — free and TCK-verified. Azul Zulu fills the gap for teams needing commercial support without Oracle’s employee-based pricing model.
Migration effort for all three is minimal: swap the JDK binary. Most applications require zero code changes. SDKMAN makes it straightforward:
# Install Temurin 25 via SDKMAN
sdk install java 25-tem
# Or Amazon Corretto 25
sdk install java 25-amznThe Adoptium migration guide documents proprietary API differences for any edge cases.
The Pattern Worth Noting
This is the fourth time Oracle has run the NFTC expiry on an LTS release. The Java 17 expiry in 2024 drove a significant wave of enterprise migration to Temurin and Corretto. Many of those teams broke the Oracle JDK dependency entirely — and they are not having this conversation again.
For JDK 25, the NFTC window runs to October 2028. Migrate now and stay on a free OpenJDK distribution, and the next Oracle deadline becomes irrelevant to you.
What to Do This Week
If your production services run Oracle JDK 21: audit your install count, check framework compatibility against JDK 25, and pick a migration path before the October CPU drops. Waiting until then to start planning means leaving a known security gap on the table. Oracle’s official NFTC announcement spells out the exact timelines.
