OpenJDK 17.0.5 Released

Andrew Hughes gnu.andrew at
Wed Oct 26 05:18:43 UTC 2022

We are pleased to announce the release of OpenJDK 17.0.5.

The source tarball is available from:


The tarball is accompanied by a digital signature available at:


This is signed by our Red Hat OpenJDK key (openjdk at

PGP Key: rsa4096/0x92EF8D39DC13168F (hkp://
Fingerprint = CA5F 11C6 CE22 644D 42C6  AC44 92EF 8D39 DC13 168F

SHA256 checksums:

0a7851708fbb13ba160b9da247a62067ee60f93c1f971cd8dfe032cc8f81b0b1  openjdk-17.0.5+8.tar.xz
331d6b0bda37bbdcf141ebf2ddbebde9b38726669418200170057303a85d0835  openjdk-17.0.5+8.tar.xz.sig

The checksums can be downloaded from:


New in release OpenJDK 17.0.5 (2022-10-18):
Live versions of these release notes can be found at:

* Security fixes
  - JDK-8282252: Improve BigInteger/Decimal validation
  - JDK-8285662: Better permission resolution
  - JDK-8286077, CVE-2022-21618: Wider MultiByte conversions
  - JDK-8286511: Improve macro allocation
  - JDK-8286519: Better memory handling
  - JDK-8286526, CVE-2022-21619: Improve NTLM support
  - JDK-8286910, CVE-2022-21624: Improve JNDI lookups
  - JDK-8286918, CVE-2022-21628: Better HttpServer service
  - JDK-8287446: Enhance icon presentations
  - JDK-8288508: Enhance ECDSA usage
  - JDK-8289366, CVE-2022-39399: Improve HTTP/2 client usage
  - JDK-8289853: Update HarfBuzz to 4.4.1
  - JDK-8290334: Update FreeType to 2.12.1
* Other changes
  - JDK-6782021: It is not possible to read local computer certificates with the SunMSCAPI provider
  - JDK-6854300: [TEST_BUG] java/awt/event/MouseEvent/SpuriousExitEnter/ fails in jdk6u14 & jdk7
  - JDK-7131823: bug in GIFImageReader
  - JDK-8017175: [TESTBUG] javax/swing/JPopupMenu/4634626/ sometimes failed on mac
  - JDK-8028265: Add legacy tz tests to OpenJDK
  - JDK-8028998: [TEST_BUG] [macosx] java/awt/dnd/DropTargetEnterExitTest/ failed
  - JDK-8079267: [TEST_BUG] Test java/awt/Frame/MiscUndecorated/ fails
  - JDK-8159694: HiDPI, Unity, java/awt/dnd/DropTargetEnterExitTest/
  - JDK-8169468: fails because FS Window didn't receive all resizes!
  - JDK-8172065: javax/swing/JTree/4908142/ The selected index should be "aad"
  - JDK-8178969: [TESTBUG] Wrong reporting of gc/g1/humongousObjects/TestHeapCounters test.
  - JDK-8211002: test/jdk/java/lang/Math/ skips testing for non-corner-case values
  - JDK-8212096: javax/net/ssl/ServerName/ failed intermittently due to SSLException: Tag mismatch
  - JDK-8223543: [TESTBUG] Regression test java/awt/Graphics2D/DrawString/ has issues
  - JDK-8225122: Test fails when Windows desktop is scaled.
  - JDK-8227651: Tests fail with SSLProtocolException: Input record too big
  - JDK-8240903: Add test to check that jmod hashes are reproducible
  - JDK-8254318: Remove .hgtags
  - JDK-8255724: [XRender] the BlitRotateClippedArea test fails on Linux in the XR pipeline
  - JDK-8256844: Make NMT late-initializable
  - JDK-8257534: misc tests failed with "NoClassDefFoundError: Could not initialize class java.util.concurrent.ThreadLocalRandom"
  - JDK-8264666: Change implementation of safeAdd/safeMult in the LCMSImageLayout class
  - JDK-8264792: The NumberFormat for locale sq_XK formats price incorrectly.
  - JDK-8265360: several compiler/whitebox tests fail with "private compiler.whitebox.SimpleTestCaseHelper(int) must be compiled"
  - JDK-8269039: Disable SHA-1 Signed JARs
  - JDK-8269556: sun/tools/jhsdb/ fails with RuntimeException 'JShellToolProvider' missing from stdout/stderr
  - JDK-8270090: C2: LCM may prioritize CheckCastPP nodes over projections
  - JDK-8270312: Error: Not a test or directory containing tests: java/awt/print/PrinterJob/
  - JDK-8271078: jdk/incubator/vector/ failed a subtest
  - JDK-8271344: Windows product version issue
  - JDK-8272352: Java launcher can not parse Chinese character when system locale is set to UTF-8
  - JDK-8272417: ZGC: fastdebug build crashes when printing ClassLoaderData
  - JDK-8272736: [JVMCI] Add API for reading and writing JVMCI thread locals
  - JDK-8272815: jpackage --type rpm produces an error: Invalid or unsupported type: [null]
  - JDK-8273040: Turning off JpAllowDowngrades (or Upgrades)
  - JDK-8273115: CountedLoopEndNode::stride_con crash in debug build with -XX:+TraceLoopOpts
  - JDK-8273506: java Robot API did the 'm' keypress and caused /awt/event/KeyEvent/KeyCharTest/KeyCharTest.html is timing out on macOS 12
  - JDK-8274434: move os::get_default_process_handle and os::dll_lookup to os_posix for POSIX platforms
  - JDK-8274517: java/util/DoubleStreamSums/ fails with expected [true] but found [false]
  - JDK-8274597: Some of the dnd tests time out and fail intermittently
  - JDK-8274856: Failing jpackage tests with fastdebug/release build
  - JDK-8275689: [TESTBUG] Use color tolerance only for XRender in BlitRotateClippedArea test
  - JDK-8275887: jarsigner prints invalid digest/signature algorithm warnings if keysize is weak/disabled
  - JDK-8276546: [IR Framework] Whitelist and ignore CompileThreshold
  - JDK-8276837: [macos]: Error when signing the additional launcher
  - JDK-8277429: Conflicting jpackage static library name
  - JDK-8277493: [REDO] Quarantined jpackage apps are labeled as "damaged"
  - JDK-8278067: Make HttpURLConnection default keep alive timeout configurable
  - JDK-8278233: [macos] tools/jpackage tests timeout due to /usr/bin/osascript
  - JDK-8278311: Debian packaging doesn't work
  - JDK-8278609: [macos] accessibility frame is misplaced on a secondary monitor on macOS
  - JDK-8278612: [macos] test/jdk/java/awt/dnd/RemoveDropTargetCrashTest crashes with VoiceOver on macOS
  - JDK-8279032: compiler/loopopts/ times out with -XX:TieredStopAtLevel < 4
  - JDK-8279370: jdk.jpackage/share/native/applauncher/JvmLauncher.cpp fails to build with GCC 6.3.0
  - JDK-8279622: C2: miscompilation of map pattern as a vector reduction
  - JDK-8280233: Temporarily disable Unix domain sockets in Windows PipeImpl
  - JDK-8280550: SplittableRandom#nextDouble(double,double) can return result >= bound
  - JDK-8280696: C2 compilation hits assert(is_dominator(c, n_ctrl)) failed
  - JDK-8280863: Update build README to reflect that MSYS2 is supported
  - JDK-8280913: Create a regression test for JRootPane.setDefaultButton() method
  - JDK-8280944: Enable Unix domain sockets in Windows Selector notification mechanism
  - JDK-8280950: RandomGenerator:NextDouble() default behavior non conformant after JDK-8280550 fix
  - JDK-8281181: Do not use CPU Shares to compute active processor count
  - JDK-8281183: RandomGenerator:NextDouble() default behavior partially fixed by JDK-8280950
  - JDK-8281297: TestStressG1Humongous fails with guarantee(is_range_uncommitted)
  - JDK-8281535: Create a regression test for JDK-4670051
  - JDK-8281569: Create tests for Frame.setMinimumSize() method
  - JDK-8281628: KeyAgreement : generateSecret intermittently not resetting
  - JDK-8281738: Create a regression test for checking the 'Space' key activation of focused Button
  - JDK-8281745: Create a regression test for JDK-4514331
  - JDK-8281988: Create a regression test for JDK-4618767
  - JDK-8282007: Assorted enhancements to jpackage testing framework
  - JDK-8282046: Create a regression test for JDK-8000326
  - JDK-8282214: Upgrade JQuery to version 3.6.0
  - JDK-8282234: Create a regression test for JDK-4532513
  - JDK-8282280: Update Xerces to Version 2.12.2
  - JDK-8282306: os::is_first_C_frame(frame*) crashes on invalid link access
  - JDK-8282343: Create a regression test for JDK-4518432
  - JDK-8282351: jpackage does not work if class file has `$$` in the name on windows
  - JDK-8282407: Missing ')' in
  - JDK-8282467: add extra diagnostics for JDK-8268184
  - JDK-8282477: [x86, aarch64] vmassert(_last_Java_pc == NULL, "already walkable"); fails with async profiler
  - JDK-8282538: PKCS11 tests fail on CentOS Stream 9
  - JDK-8282548: Create a regression test for JDK-4330998
  - JDK-8282555: Missing memory edge when spilling MoveF2I, MoveD2L etc
  - JDK-8282640: Create a test for JDK-4740761
  - JDK-8282778: Create a regression test for JDK-4699544
  - JDK-8282789: Create a regression test for the JTree usecase of JDK-4618767
  - JDK-8282860: Write a regression test for JDK-4164779
  - JDK-8282933: Create a test for JDK-4529616
  - JDK-8282936: Write a regression test for JDK-4615365
  - JDK-8282937: Write a regression test for JDK-4820080
  - JDK-8282947: JFR: Dump on shutdown live-locks in some conditions
  - JDK-8283015: Create a test for JDK-4715496
  - JDK-8283087: Create a test or JDK-4715503
  - JDK-8283245: Create a test for JDK-4670319
  - JDK-8283277: ISO 4217 Amendment 171 Update
  - JDK-8283441: C2: segmentation fault in ciMethodBlocks::make_block_at(int)
  - JDK-8283457: [macos] libpng build failures with Xcode13.3
  - JDK-8283493: Create an automated regression test for RFE 4231298
  - JDK-8283507: Create a regression test for RFE 4287690
  - JDK-8283562: JDK-8282306 breaks gtests on zero
  - JDK-8283597: [REDO] Invalid generic signature for redefined classes
  - JDK-8283621: Write a regression test for CCC4400728
  - JDK-8283623: Create an automated regression test for JDK-4525475
  - JDK-8283624: Create an automated regression test for RFE-4390885
  - JDK-8283712: Create a manual test framework class
  - JDK-8283723: Update Visual Studio 2022 to version 17.1.0 for Oracle builds on Windows
  - JDK-8283803: Remove jtreg tag manual=yesno for java/awt/print/PrinterJob/ and fix test
  - JDK-8283849: AsyncGetCallTrace may crash JVM on guarantee
  - JDK-8283903: GetContainerCpuLoad does not return the correct result in share mode
  - JDK-8283911: DEFAULT_PROMOTED_VERSION_PRE not reset to 'ea' for jdk-17.0.4
  - JDK-8284014: Menu items with submenus in JPopupMenu are not spoken on macOS
  - JDK-8284067: jpackage'd launcher reports non-zero exit codes with error prompt
  - JDK-8284077: Create an automated test for JDK-4170173
  - JDK-8284294: Create an automated regression test for RFE 4138746
  - JDK-8284358: Unreachable loop is not removed from C2 IR, leading to a broken graph
  - JDK-8284367: JQuery UI upgrade from 1.12.1 to 1.13.1
  - JDK-8284521: Write an automated regression test for RFE 4371575
  - JDK-8284535: Fix test that is failing with Parse Exception
  - JDK-8284675: "jpackage.exe" creates application launcher without Windows Application Manfiest
  - JDK-8284680: sun.font.FontConfigManager.getFontConfig() leaks charset
  - JDK-8284686: Interval of < 1 ms disables ExecutionSample events
  - JDK-8284694: Avoid evaluating SSLAlgorithmConstraints twice
  - JDK-8284883: JVM crash: guarantee(sect->end() <= sect->limit()) failed: sanity on AVX512
  - JDK-8284898: Enhance PassFailJFrame
  - JDK-8284944: assert(cnt++ < 40) failed: infinite cycle in loop optimization
  - JDK-8284950: CgroupV1 detection code should consider memory.swappiness
  - JDK-8284956: Potential leak awtImageData/color_data when initializes X11GraphicsEnvironment
  - JDK-8284977: MetricsTesterCgroupV2.getLongValueEntryFromFile fails when named value doesn't exist
  - JDK-8285081: Improve XPath operators count accuracy
  - JDK-8285097: Duplicate XML keys in and
  - JDK-8285301: C2: assert(!requires_atomic_access) failed: can't ensure atomicity
  - JDK-8285380: Fix typos in security
  - JDK-8285398: Cache the results of constraint checks
  - JDK-8285617: Fix java/awt/print/PrinterJob/ImagePrinting/ manual test
  - JDK-8285693: Create an automated test for JDK-4702199
  - JDK-8285696: AlgorithmConstraints:permits not throwing IllegalArgumentException when 'alg'  is null
  - JDK-8285730: unify _WIN32_WINNT settings
  - JDK-8285820: C2: LCM prioritizes locally dependent CreateEx nodes over projections after 8270090
  - JDK-8285923: [REDO] JDK-8285802 AArch64: Consistently handle offsets in MacroAssembler as 64-bit quantities
  - JDK-8286114: [test] show real exception in bomb call in sun/rmi/runtime/Log/checkLogging/
  - JDK-8286122: [macos]: App bundle cannot upload to Mac App Store due to info.plist embedded in java exe
  - JDK-8286177: C2: "failed: non-reduction loop contains reduction nodes" assert failure
  - JDK-8286211: Update PCSC-Lite for Suse Linux to 1.9.5
  - JDK-8286266: [macos] Voice over moving JTable column to be the first column JVM crashes
  - JDK-8286277: CDS VerifyError when calling clone() on object array
  - JDK-8286314: Trampoline not created for far runtime targets outside small CodeCache
  - JDK-8286429: jpackageapplauncher build fails intermittently in Tier[45]
  - JDK-8286573: Remove the unnecessary method Attr#attribTopLevel and its usage
  - JDK-8286582: Build fails on macos aarch64 when using --with-zlib=bundled
  - JDK-8286625: C2 fails with assert(!n->is_Store() && !n->is_LoadStore()) failed: no node with a side effect
  - JDK-8286638: C2: CmpU needs to do more precise over/underflow analysis
  - JDK-8286869: unify os::dir_is_empty across posix platforms
  - JDK-8286870: Memory leak with RepeatCompilation
  - JDK-8287016: Bump update version for OpenJDK: jdk-17.0.5
  - JDK-8287073: NPE from CgroupV2Subsystem.getInstance()
  - JDK-8287091: aarch64 : guarantee(val < (1ULL << nbits)) failed: Field too big for insn
  - JDK-8287107: CgroupSubsystemFactory.setCgroupV2Path asserts with freezer controller
  - JDK-8287113: JFR: Periodic task thread uses period for method sampling events
  - JDK-8287125: [macos] Multiple jpackage tests fail/timeout on same host
  - JDK-8287202: GHA: Add macOS aarch64 to the list of default platforms for workflow_dispatch event
  - JDK-8287223: C1: Inlining attempt through MH::invokeBasic() with null receiver
  - JDK-8287366: Improve test failure reporting in GHA
  - JDK-8287396: LIR_Opr::vreg_number() and data() can return negative number
  - JDK-8287432: C2: assert(tn->in(0) != __null) failed: must have live top node
  - JDK-8287463: JFR: Disable on Windows
  - JDK-8287663: Add a regression test for JDK-8287073
  - JDK-8287672: jtreg test com/sun/jndi/ldap/ fails intermittently in nightly run
  - JDK-8287724: Fix various issues with msys2
  - JDK-8287735: Provide separate event category for dll operations
  - JDK-8287741: Fix of JDK-8287107 (unused cgv1 freezer controller) was incomplete
  - JDK-8287824: The MTPerLineTransformValidation tests has a typo in the @run tag
  - JDK-8287895: Some langtools tests fail on msys2
  - JDK-8287896: fail on msys2
  - JDK-8287902: UnreadableRB case in MissingResourceCauseTest is not working reliably on Windows
  - JDK-8287906: Rewrite of GitHub Actions (GHA) sanity tests
  - JDK-8287917: System.loadLibrary does not work on Big Sur if JDK is built with macOS SDK 10.15 and earlier
  - JDK-8288000: compiler/loopopts/ fails with release VMs
  - JDK-8288003: log events for os::dll_unload
  - JDK-8288303: C1: Miscompilation due to broken Class.getModifiers intrinsic
  - JDK-8288360: CI: ciInstanceKlass::implementor() is not consistent for well-known classes
  - JDK-8288399: MacOS debug symbol files not always deterministic in reproducible builds
  - JDK-8288467: remove memory_operand assert for spilled instructions
  - JDK-8288499: Restore cancel-in-progress in GHA
  - JDK-8288599: com/sun/management/OperatingSystemMXBean/ Expected total swap size ... but getTotalSwapSpaceSize returned ...
  - JDK-8288754: GCC 12 fails to build zReferenceProcessor.cpp
  - JDK-8288781: C1: LIR_OpVisitState::maxNumberOfOperands too small
  - JDK-8288985: P11TlsKeyMaterialGenerator should work with ChaCha20-Poly1305
  - JDK-8288992: AArch64: CMN should be handled the same way as CMP
  - JDK-8289127: Apache Lucene triggers: DEBUG MESSAGE: duplicated predicate failed which is impossible
  - JDK-8289147: unify os::infinite_sleep on posix platforms
  - JDK-8289197: [17u] Push of backport of 8286177 did not remove assertion
  - JDK-8289471: Issue in Initialization of keys in and
  - JDK-8289477: Memory corruption with CPU_ALLOC, CPU_FREE on muslc
  - JDK-8289486: Improve XSLT XPath operators count efficiency
  - JDK-8289549: ISO 4217 Amendment 172 Update
  - JDK-8289569: [test] java/lang/ProcessBuilder/ fails on Alpine/musl
  - JDK-8289695: [TESTBUG] fails on cgroups v2 and crun
  - JDK-8289697: buffer overflow in MTLVertexCache.m: MTLVertexCache_AddGlyphQuad
  - JDK-8289799: Build warning in methodData.cpp memset zero-length parameter
  - JDK-8289856: [PPC64] SIGSEGV in C2Compiler::init_c2_runtime() after JDK-8289060
  - JDK-8289910: unify os::message_box across posix platforms
  - JDK-8290000: Bump macOS GitHub actions to macOS 11
  - JDK-8290004: [PPC64] JfrGetCallTrace: assert(_pc != nullptr) failed: must have PC
  - JDK-8290020: Deadlock in leakprofiler::emit_events during shutdown
  - JDK-8290082: [PPC64] ZGC C2 load barrier stub needs to preserve vector registers
  - JDK-8290246: test fails "assert(init != __null) failed: initialization not found"
  - JDK-8290417: CDS cannot archive lamda proxy with useImplMethodHandle
  - JDK-8290456: remove os::print_statistics()
  - JDK-8291595: [17u] Delete files missed in backport of 8269039
  - JDK-8291633: Build failures with GCC 11, Alpine 3 due to incompatible casts from nullptr
  - JDK-8292579: (tz) Update Timezone Data to 2022c
  - JDK-8295056: [17u] Remove designator DEFAULT_PROMOTED_VERSION_PRE=ea for release 17.0.5

Notes on individual issues:


JDK-8278067: Make HttpURLConnection Default Keep Alive Timeout Configurable
Two system properties have been added which control the keep alive
behavior of HttpURLConnection in the case where the server does not
specify a keep alive time. Two properties are defined for controlling
connections to servers and proxies separately. They are:

* `http.keepAlive.time.server`
* `http.keepAlive.time.proxy`

respectively. More information about them can be found on the
Networking Properties page:


JDK-6782021: Windows KeyStore Updated to Include Access to the Local Machine Location
The Windows KeyStore support in the SunMSCAPI provider has been
expanded to include access to the local machine location. The new
keystore types are:


The following keystore types were also added, allowing developers to
make it clear they map to the current user:

* "Windows-MY-CURRENTUSER" (same as "Windows-MY")
* "Windows-ROOT-CURRENTUSER" (same as "Windows-ROOT")

JDK-8286918: Better HttpServer service
The HttpServer can be optionally configured with a maximum connection
limit by setting the jdk.httpserver.maxConnections system property. A
value of 0 or a negative integer is ignored and considered to
represent no connection limit. In the case of a positive integer
value, any newly accepted connections will be first checked against
the current count of established connections and, if the configured
limit has been reached, then the newly accepted connection will be
closed immediately.


JDK-8281181: CPU Shares Ignored When Computing Active Processor Count
Previous JDK releases used an incorrect interpretation of the Linux
cgroups parameter "cpu.shares". This might cause the JVM to use fewer
CPUs than available, leading to an under utilization of CPU resources
when the JVM is used inside a container.

Starting from this JDK release, by default, the JVM no longer
considers "cpu.shares" when deciding the number of threads to be used
by the various thread pools. The `-XX:+UseContainerCpuShares`
command-line option can be used to revert to the previous
behavior. This option is deprecated and may be removed in a future JDK


JDK-8269039: Disabled SHA-1 Signed JARs
JARs signed with SHA-1 algorithms are now restricted by default and
treated as if they were unsigned. This applies to the algorithms used
to digest, sign, and optionally timestamp the JAR. It also applies to
the signature and digest algorithms of the certificates in the
certificate chain of the code signer and the Timestamp Authority, and
any CRLs or OCSP responses that are used to verify if those
certificates have been revoked. These restrictions also apply to
signed JCE providers.

To reduce the compatibility risk for JARs that have been previously
timestamped, there is one exception to this policy:

- Any JAR signed with SHA-1 algorithms and timestamped prior to
  January 01, 2019 will not be restricted.

This exception may be removed in a future JDK release. To determine if
your signed JARs are affected by this change, run:

$ jarsigner -verify -verbose -certs`

on the signed JAR, and look for instances of "SHA1" or "SHA-1" and
"disabled" and a warning that the JAR will be treated as unsigned in
the output.

For example:

   Signed by "CN="Signer""
   Digest algorithm: SHA-1 (disabled)
   Signature algorithm: SHA1withRSA (disabled), 2048-bit key

   WARNING: The jar will be treated as unsigned, because it is signed with a weak algorithm that is now disabled by the security property:

   jdk.jar.disabledAlgorithms=MD2, MD5, RSA keySize < 1024, DSA keySize < 1024, SHA1 denyAfter 2019-01-01

JARs affected by these new restrictions should be replaced or
re-signed with stronger algorithms.

Users can, *at their own risk*, remove these restrictions by modifying
the `` configuration file (or override it by using the
`` system property) and removing "SHA1 usage
SignedJAR & denyAfter 2019-01-01" from the
`jdk.certpath.disabledAlgorithms` security property and "SHA1
denyAfter 2019-01-01" from the `jdk.jar.disabledAlgorithms` security

Andrew :)
Pronouns: he / him or they / them
Senior Free Java Software Engineer
OpenJDK Package Owner
Red Hat, Inc. (

PGP Key: ed25519/0xCFDA0F9B35964222 (hkp://
Fingerprint = 5132 579D D154 0ED2 3E04  C5A0 CFDA 0F9B 3596 4222
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <>

More information about the jdk-updates-dev mailing list