Refer: https://docs.azul.com/core/release-notes

Fixed Issues$$$This section covers all issues that were fixed in this release.$$$$$$Fixed Common Vulnerabilities and Exposures$$$This section summarizes Common Vulnerabilities and Exposures (CVE) fixed in this release.$$$$$$CVE #tComponenttProtocoltRemote Exploit w/o Auth.tBase ScoretAttack VectortAttack ComplextPrivileges Req’dtUser InteracttScopetConfiden-tialitytIntegritytAvailabilitytAzul Zulu Versions AffectedtNotes$$$CVE-2024-47606$$$$$$JavaFX (gstreamer)$$$$$$Multiple$$$$$$Yes$$$$$$7.5$$$$$$Network$$$$$$High$$$$$$None$$$$$$Required$$$$$$Unchanged$$$$$$High$$$$$$High$$$$$$High$$$$$$24; 21; 17; 11; 8$$$$$$Note 1$$$$$$CVE-2024-54534$$$$$$JavaFX (WebKitGTK)$$$$$$Multiple$$$$$$Yes$$$$$$7.5$$$$$$Network$$$$$$High$$$$$$None$$$$$$Required$$$$$$Unchanged$$$$$$High$$$$$$High$$$$$$High$$$$$$24; 21; 17; 11; 8$$$$$$Note 1$$$$$$CVE-2025-21587$$$$$$JSSE$$$$$$Multiple$$$$$$Yes$$$$$$7.4$$$$$$Network$$$$$$High$$$$$$None$$$$$$None$$$$$$Unchanged$$$$$$High$$$$$$High$$$$$$None$$$$$$24; 21; 17; 11; 8; 7; 6$$$$$$Note 2$$$$$$CVE-2025-30698$$$$$$2D$$$$$$Multiple$$$$$$Yes$$$$$$5.6$$$$$$Network$$$$$$High$$$$$$None$$$$$$None$$$$$$Unchanged$$$$$$Low$$$$$$Low$$$$$$Low$$$$$$24; 21; 17; 11; 8; 7; 6$$$$$$Note 1$$$$$$CVE-2025-30691$$$$$$Compiler$$$$$$Multiple$$$$$$Yes$$$$$$4.8$$$$$$Network$$$$$$High$$$$$$None$$$$$$None$$$$$$Unchanged$$$$$$Low$$$$$$Low$$$$$$None$$$$$$24; 21; 17; 11; 8$$$$$$Note 2$$$$$$CVE-2025-23083 $$$$$$Node (Node.js)$$$$$$None$$$$$$No$$$$$$7.7$$$$$$Local$$$$$$Low$$$$$$None$$$$$$None$$$$$$Unchanged$$$$$$High$$$$$$High$$$$$$None$$$$$$None$$$$$$$$$Notes:$$$$$$IDtNotes$$$1$$$$$$This vulnerability applies to Java deployments; typically in clients; that load and run untrusted code (e.g.; code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments; typically in servers; that load and run only trusted code (e.g.; code installed by an administrator).$$$$$$2$$$$$$This vulnerability can be exploited by using APIs in the specified Component; e.g.; through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments; that load and run untrusted code (e.g.; code that comes from the internet) and rely on the Java sandbox for security.$$$$$$Additional CVEs addressed are:$$$$$$The patch for CVE-2024-54534 also addresses CVE-2024-27856; CVE-2024-40866; CVE-2024-44185; CVE-2024-44187; CVE-2024-44244; CVE-2024-44296; CVE-2024-44308; CVE-2024-44309; CVE-2024-54479; CVE-2024-54502; CVE-2024-54505; CVE-2024-54508; CVE-2024-54543; CVE-2025-24143; CVE-2025-24150; CVE-2025-24158; and CVE-2025-24162.$$$$$$The patch for CVE-2024-47606 also addresses CVE-2024-47544; CVE-2024-47545; CVE-2024-47546; CVE-2024-47596; CVE-2024-47597; CVE-2024-47775; CVE-2024-47776; CVE-2024-47777; and CVE-2024-47778.$$$$$$Non-CVE Security Fixes$$$The following table summarizes non-CVE security fixes implemented in this release.$$$$$$OpenJDK Patch IDtAzul Zulu VersiontSynopsistCPU/PSU$$$JDK-8337494$$$$$$6; 7; 8; 11; 17; 21; 24$$$$$$Clarify JarInputStream behavior$$$$$$CPU;PSU$$$$$$JDK-8337496$$$$$$6; 7; 8; 11; 17; 21; 24$$$$$$Improve jarsigner utility handling of missing content$$$$$$CPU;PSU$$$$$$JDK-8337497$$$$$$6; 7; 8; 11; 17; 21; 24$$$$$$Improve jar utility handling$$$$$$CPU;PSU$$$$$$JDK-8342562$$$$$$7; 8; 11; 17; 21; 24$$$$$$Enhance Deflater operations$$$$$$CPU;PSU$$$$$$JDK-8343803$$$$$$17; 21; 24$$$$$$Enhance garbage collection support$$$$$$CPU;PSU$$$$$$JDK-8347847$$$$$$6; 7; 8; 11; 17; 21; 24$$$$$$Enhance jar file support$$$$$$CPU;PSU$$$$$$JDK-8337232$$$$$$24$$$$$$Improve Java Process Launching$$$$$$PSU$$$$$$JDK-8341493$$$$$$24$$$$$$Improve HttpClient support$$$$$$PSU$$$$$$

Fixed Issues$$$This section covers all issues that were fixed in this release.$$$$$$Fixed Common Vulnerabilities and Exposures$$$This section summarizes Common Vulnerabilities and Exposures (CVE) fixed in this release.$$$$$$CVE #tComponenttProtocoltRemote Exploit w/o Auth.tBase ScoretAttack VectortAttack ComplextPrivileges Req’dtUser InteracttScopetConfiden-tialitytIntegritytAvailabilitytAzul Zulu Versions AffectedtNotes$$$CVE-2024-47606$$$$$$JavaFX (gstreamer)$$$$$$Multiple$$$$$$Yes$$$$$$7.5$$$$$$Network$$$$$$High$$$$$$None$$$$$$Required$$$$$$Unchanged$$$$$$High$$$$$$High$$$$$$High$$$$$$24; 21; 17; 11; 8$$$$$$Note 1$$$$$$CVE-2024-54534$$$$$$JavaFX (WebKitGTK)$$$$$$Multiple$$$$$$Yes$$$$$$7.5$$$$$$Network$$$$$$High$$$$$$None$$$$$$Required$$$$$$Unchanged$$$$$$High$$$$$$High$$$$$$High$$$$$$24; 21; 17; 11; 8$$$$$$Note 1$$$$$$CVE-2025-21587$$$$$$JSSE$$$$$$Multiple$$$$$$Yes$$$$$$7.4$$$$$$Network$$$$$$High$$$$$$None$$$$$$None$$$$$$Unchanged$$$$$$High$$$$$$High$$$$$$None$$$$$$24; 21; 17; 11; 8; 7; 6$$$$$$Note 2$$$$$$CVE-2025-30698$$$$$$2D$$$$$$Multiple$$$$$$Yes$$$$$$5.6$$$$$$Network$$$$$$High$$$$$$None$$$$$$None$$$$$$Unchanged$$$$$$Low$$$$$$Low$$$$$$Low$$$$$$24; 21; 17; 11; 8; 7; 6$$$$$$Note 1$$$$$$CVE-2025-30691$$$$$$Compiler$$$$$$Multiple$$$$$$Yes$$$$$$4.8$$$$$$Network$$$$$$High$$$$$$None$$$$$$None$$$$$$Unchanged$$$$$$Low$$$$$$Low$$$$$$None$$$$$$24; 21; 17; 11; 8$$$$$$Note 2$$$$$$CVE-2025-23083 $$$$$$Node (Node.js)$$$$$$None$$$$$$No$$$$$$7.7$$$$$$Local$$$$$$Low$$$$$$None$$$$$$None$$$$$$Unchanged$$$$$$High$$$$$$High$$$$$$None$$$$$$None$$$$$$$$$Notes:$$$$$$IDtNotes$$$1$$$$$$This vulnerability applies to Java deployments; typically in clients; that load and run untrusted code (e.g.; code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments; typically in servers; that load and run only trusted code (e.g.; code installed by an administrator).$$$$$$2$$$$$$This vulnerability can be exploited by using APIs in the specified Component; e.g.; through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments; that load and run untrusted code (e.g.; code that comes from the internet) and rely on the Java sandbox for security.$$$$$$Additional CVEs addressed are:$$$$$$The patch for CVE-2024-54534 also addresses CVE-2024-27856; CVE-2024-40866; CVE-2024-44185; CVE-2024-44187; CVE-2024-44244; CVE-2024-44296; CVE-2024-44308; CVE-2024-44309; CVE-2024-54479; CVE-2024-54502; CVE-2024-54505; CVE-2024-54508; CVE-2024-54543; CVE-2025-24143; CVE-2025-24150; CVE-2025-24158; and CVE-2025-24162.$$$$$$The patch for CVE-2024-47606 also addresses CVE-2024-47544; CVE-2024-47545; CVE-2024-47546; CVE-2024-47596; CVE-2024-47597; CVE-2024-47775; CVE-2024-47776; CVE-2024-47777; and CVE-2024-47778.$$$$$$Non-CVE Security Fixes$$$The following table summarizes non-CVE security fixes implemented in this release.$$$$$$OpenJDK Patch IDtAzul Zulu VersiontSynopsistCPU/PSU$$$JDK-8337494$$$$$$6; 7; 8; 11; 17; 21; 24$$$$$$Clarify JarInputStream behavior$$$$$$CPU;PSU$$$$$$JDK-8337496$$$$$$6; 7; 8; 11; 17; 21; 24$$$$$$Improve jarsigner utility handling of missing content$$$$$$CPU;PSU$$$$$$JDK-8337497$$$$$$6; 7; 8; 11; 17; 21; 24$$$$$$Improve jar utility handling$$$$$$CPU;PSU$$$$$$JDK-8342562$$$$$$7; 8; 11; 17; 21; 24$$$$$$Enhance Deflater operations$$$$$$CPU;PSU$$$$$$JDK-8343803$$$$$$17; 21; 24$$$$$$Enhance garbage collection support$$$$$$CPU;PSU$$$$$$JDK-8347847$$$$$$6; 7; 8; 11; 17; 21; 24$$$$$$Enhance jar file support$$$$$$CPU;PSU$$$$$$JDK-8337232$$$$$$24$$$$$$Improve Java Process Launching$$$$$$PSU$$$$$$JDK-8341493$$$$$$24$$$$$$Improve HttpClient support$$$$$$PSU$$$$$$

Fixed Issues$$$This section covers all issues that were fixed in this release.$$$$$$Fixed Common Vulnerabilities and Exposures$$$This section summarizes Common Vulnerabilities and Exposures (CVE) fixed in this release.$$$$$$CVE #tComponenttProtocoltRemote Exploit w/o Auth.tBase ScoretAttack VectortAttack ComplextPrivileges Req’dtUser InteracttScopetConfiden-tialitytIntegritytAvailabilitytAzul Zulu Versions AffectedtNotes$$$CVE-2025-21502$$$$$$Hotspot$$$$$$Multiple$$$$$$Yes$$$$$$4.8$$$$$$Network$$$$$$High$$$$$$None$$$$$$None$$$$$$Unchanged$$$$$$Low$$$$$$Low$$$$$$None$$$$$$23; 21; 17; 11$$$$$$Note 1$$$$$$CVE-2025-0509 $$$$$$Install (Sparkle)$$$$$$Multiple$$$$$$No$$$$$$7.3$$$$$$Adjacent Network$$$$$$High$$$$$$High$$$$$$Required$$$$$$Changed$$$$$$High$$$$$$High$$$$$$High$$$$$$None$$$$$$$$$Notes:$$$$$$IDtNotes$$$1$$$$$$This vulnerability can be exploited by using APIs in the specified Component; e.g.; through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments; that load and run untrusted code (e.g.; code that comes from the internet) and rely on the Java sandbox for security.$$$$$$Non-CVE Security Fixes$$$The following table summarizes non-CVE security fixes implemented in this release.$$$$$$OpenJDK Patch IDtAzul Zulu VersiontSynopsistCPU/PSU$$$JDK-8335428$$$$$$6; 7; 8; 11; 17; 21; 23$$$$$$Enhanced building of processes$$$$$$CPU;PSU$$$$$$JDK-8335714$$$$$$8; 11; 17; 21; 23$$$$$$Enhance playing MP3s$$$$$$CPU;PSU$$$$$$JDK-8335715$$$$$$8; 11; 17; 21; 23$$$$$$Improve Direct Show support$$$$$$CPU;PSU$$$$$$JDK-8336564$$$$$$6; 7; 8; 11; 17; 21; 23$$$$$$Enhance mask blit functionality redux$$$$$$CPU;PSU$$$$$$JDK-8337499$$$$$$6; 7; 8; 11; 17; 21; 23$$$$$$Improve jar utility handling of existing content$$$$$$CPU;PSU$$$$$$JDK-8339180$$$$$$6; 7; 8; 11; 17; 21; 23$$$$$$Enhanced Building of Processes: Follow-on Issue$$$$$$CPU;PSU

Please refer below url for more details:$$$$$$https://docs.azul.com/core/pdfs/october-2024/azul-zulu-ca-release-notes-october-2024-rev1.0.pdf

Please refer below url for more details:$$$$$$https://docs.azul.com/core/pdfs/july-2024/azul-zulu-ca-release-notes-july-2024-rev1.1.pdf

Please refer below URL:$$$$$$https://docs.azul.com/core/pdfs/april-2024/azul-zulu-ca-release-notes-april-2024-rev1.1.pdf

Please refer below URL:$$$$$$https://docs.azul.com/core/pdfs/january-2024/azul-zulu-ca-release-notes-january-2024-rev1.1.pdf

Please refer below URL:$$$$$$https://docs.azul.com/core/zulu-openjdk/release-notes/october-2023