Are Free Distributions of OpenJDK Safe to Use?

Azul migration experts researched reasons companies choose not to migrate from Oracle Java to an OpenJDK distribution. After careful investigation, they identified six Oracle OpenJDK migration myths and produced the facts to counter each one. 

Myth 3: Using free distributions of OpenJDK will put my investment in Java at risk. 

Reality: Free, open-source software accelerates project delivery. All Java builds that pass the Technology Compatibility Kit (TCK) suite of tests are compliant with Java SE standards and are safe to use. However, without commercial support, free builds of OpenJDK won’t give you the security and stability you receive from support providers.   

The Java Technology Compatibility Kit (TCK) was created to ensure compatibility between different implementations of the Java specification. The TCK suites are Oracle’s intellectual property and require an Oracle license. Passing the entire suite of TCK tests provides a high level of confidence that an application that runs on one TCK-tested distribution will run the same way on another distribution. TCK suites often consist of more than 100,000 tests and are essential for Java’s portability — for delivering the “write once, run anywhere” promise. Even better, free, open-source software accelerates project delivery.

Using a free TCK-tested distribution will not put your investment in Java at risk. These distributions are safe to use. However, it is important to note that they are not a substitute for distributions supported by providers with a track record of ensuring Java’s security and stability. 

So why, you might ask, would a company pay for commercially supported Java? 

The case for commercially supported Java 

JDK versions 6 and 7, and early releases of 8, are free to use. Oracle still supports JDK 8, but no longer supports JDK 6 and 7, which makes them vulnerable to security risks. Common vulnerabilities and exposures (CVEs) have been continuously found in Java 6, which reached end of life in December 2018, and Java 7, which reached end of life in July 2022.

With commercial support, subscribers receive security patches that protect these older versions of Java, as well as Critical Patch Updates (CPUs) for current versions of Java that enable them to better meet compliance requirements.

Commercial support functions like insurance against unstable updates (like the Crowdstrike update that shut down businesses around the globe in July 2024). In the event of a regression in a full JDK update, Azul customers are protected — assuming they installed the CPU version with far fewer changes. (Historically, Azul CPUs have not been affected by the periodic regressions that occur in full quarterly updates)  If a customer is affected because they installed full updates, they can immediately switch to CPUs.

In addition to CPUs, commercial support providers like Azul offer SLAs for security updates and will provide critical, out-of-cycle fixes if needed.

When critical business applications run on Java, commercial support becomes essential. Beyond timely security fixes and critical bug fixes, access to globally distributed expert engineering services is crucial for root cause analysis and troubleshooting issues related to the Java Development Kit, Java Runtime Environment, or Java Virtual Machine.

Commercial support combines insurance and maintenance in one subscription, and – in the case of Azul – also offers IP protection. Azul certifies its JDKs against copyleft contamination and indemnifies customers against patent and copyright challenges.

Ensuring the security and stability of your Java applications is paramount for businesses that depend on Java. With commercial support from Azul, you can protect your investment, meet compliance requirements, and mitigate risks, all while benefiting from expert engineering services and comprehensive IP protection. That’s the case for commercial support from Azul in a nutshell.