Java 27 Released: G1 Default GC, Post-Quantum TLS, Compact Object Headers & JFR Redaction

JEP 523: G1 as Default Garbage Collector in All Environments

Java 9 made G1 the default garbage collector, but the Serial collector remained default for single-CPU environments with heaps under 1792 MB. Since then, G1 has improved: testing shows its performance now matches Serial for all heap sizes. Enhancements reducing synchronization overhead (JEP 522) mean G1 performs equally well even with fewer CPUs, and its native memory consumption has dropped to Serial levels. Because G1 equals or outperforms Serial on every metric — even in CPU- and RAM-constrained environments — it is now the default everywhere.

JEP 527: Post-Quantum Hybrid Key Exchange for TLS 1.3

Java 27 implements hybrid key-exchange algorithms for TLS 1.3, combining quantum-resistant algorithms with traditional ones. Security holds as long as either algorithm remains unbroken, providing defense against future quantum attacks while acknowledging the newer algorithms lack the decades of scrutiny traditional ones have. The JDK supports three new post-quantum hybrid schemes, each pairing ML-KEM (Module-Lattice-Based Key Encapsulation Mechanism, added via JEP 496) with ephemeral Elliptic Curve Diffie-Hellman (ECDHE):

X25519MLKEM768 : combines ECDHE with X25519 and ML-KEM-768.

SecP256r1MLKEM768 : combines ECDHE using the secp256r1 curve with ML-KEM-768.

SecP384r1MLKEM1024 : combines ECDHE using the secp384r1 curve with ML-KEM-1024.

JEP 534: Compact Object Headers Enabled by Default

Compact object headers allow the JVM to store object headers in 64 bits instead of 128 bits: 22 bits for the class pointer, 31 bits for the hash code, 4 bits reserved for Valhalla, and the remaining bits for GC age and JVM flags as before. Previewed in Java 24 (JEP 450) and finalized in Java 25, compact headers have proven stable and performant. They were tested with Oracle's full JDK test suite, and both Amazon and SAP have enabled them by default. Experiments show measurable gains:

SPECjbb2015 used 22% less heap space and 8% less CPU time.

SPECjbb2015 performed 15% fewer garbage collections with both G1 and Parallel collectors.

A highly parallel JSON parser benchmark ran 10% faster.

Java 27 enables compact object headers by default; the old layout is expected to be deprecated in a future release.

JEP 536: JFR Data Redaction

JFR recording files contain command-line arguments, environment variables, and system properties that may include secrets (passwords, tokens, etc.). Previously this data appeared in plain text, creating leakage risk when recordings are shared. JFR now redacts sensitive information by default without extra configuration. You can explicitly control redaction via new sub-options of -XX:FlightRecorderOptions: redact-argument: specifies glob-pattern filters for command-line arguments. redact-key: specifies glob-pattern filters for environment variables and system properties (key-value pairs).

Glob patterns use * and ? as wildcards. Matching arguments or keys have their values recorded as [REDACTED]. Multiple filters are separated by semicolons and evaluated in order; different sub-options are separated by commas. Example: redact any environment variable or system property named "confidential" or "CONFIDENTIAL", and any command-line argument resembling a URL with credentials:

java -XX:FlightRecorderOptions='redact-key=confidential,redact-argument=https://*:*@*' 
     -XX:StartFlightRecording:filename=dump.jfr 
     -Dconfidential=ANOTHER_SECRET 
     -jar application.jar https://john:[email protected]/login --verbose

Verify redaction with:

$ jfr print 
     --events InitialSystemProperty,InitialEnvironmentVariable 
     dump.jfr
[...]
jdk.InitialEnvironmentVariable {
  startTime = 17:39:02.244 (2026-02-15)
  key = "CONFIDENTIAL"
  value = "[REDACTED]"
}

Features Still in Preview / Incubator

JEP 531 – Lazy Constants (third preview): API for on-demand constant initialization. Changes: removed underlying isInitialized method, added orElse factory method Set.ofLazy(...).

JEP 532 – Primitive Types in Patterns, instanceof and switch (fifth preview): adds support for primitive types in instanceof and switch, and enhances pattern matching to support primitive type patterns in instanceof, switch cases, and record deconstruction. No other changes.

JEP 533 – Structured Concurrency (seventh preview): API to treat multiple concurrent tasks as a single unit. Interface changes to Joiner: join() accepts a third parameter for exceptions the StructuredTaskScope may throw; awaitAll() removed, replaced by allSuccessfulOrThrow(), anySuccessfulOrThrow(), and awaitAllSuccessfulOrThrow() (throws on exception); ExecutionException replaced by onTimeout() / timeout().

JEP 537 – Vector API (twelfth incubator): API for expressing vector computations that compile to CPU vector instructions at runtime. No changes. Will remain incubating until Valhalla features preview, as Vector API will then leverage Valhalla's performance and memory representation improvements.

JEP 538 – PEM Encoding for Cryptographic Objects (third preview): adds support for Privacy-Enhanced Mail (PEM) format. New constructors accept BASE64-encoded byte arrays; DEREncodable renamed to BinaryEncodable; added EncryptedPrivateKeyInfo.getKeyPair() method; added CryptoException for cryptographic errors.

Miscellaneous New APIs

Math.acosh(double)

and StrictMath.acosh(double): return inverse hyperbolic cosine. Math.asinh(double) and StrictMath.asinh(double): return inverse hyperbolic sine. Math.atanh(double) and StrictMath.atanh(double): return inverse hyperbolic tangent. String.encodedLength(Charset): returns byte length of the string when encoded with the given charset. BigDecimal.rootn(int, MathContext): returns approximate n-th root rounded per context. DateTimeFormatter now supports short zone offsets (e.g., +01 instead of +01:00), see JDK-8210336.

All new APIs in JDK 27 are listed in the Java Version Almanac – New APIs in Java 27.

Internal Changes, Performance, and Security

As with every release, OpenJDK 27 includes numerous performance optimizations and security enhancements. Notable performance improvements: HashMap.putAll(Map) now has a fast path when the argument is a HashMap: it directly calls putHashMapEntries(), yielding 66–86% speedup (PR #28243).

AVX2 intrinsic for binary search improves performance 1.5×–2.35× for arrays larger than thresholds ( int =256, long =768, short =512, char =512) (PR #30612).

Eliminated redundant fstat system call when opening files for writing on Unix: FileOutputStream / RandomAccessFile previously called fstat after open to reject directories, but the open already fails with EISDIR, making the extra syscall unnecessary.

Crypto acceleration: new AVX2 intrinsics for AES/ECB and SHA-3; new RISC-V intrinsics for AES/CTR.

Security enhancements:

Added TLS certificate compression support (JDK-8372526).

Added WISeKey certificates to the JVM trust store (JDK-8372351).

New jcmd VM.security_properties command lists enabled security properties (JDK-8364182).

HSS/LMS signature algorithms now support additional parameter sets defined in RFC 9858, introducing new parameter sets for SHA-256/192 and SHAKE-based hash functions (SHAKE256/256, SHAKE256/192), enabling shorter signatures.

Additionally, jcmd now supports bash completion (JDK-8357439).

The experimental JVM Compiler Interface (JVMCI) has been removed (JDK-8382582). The release notes state that after over a decade of experimentation, the maintenance cost of JVMCI in the JDK exceeded its benefit for the limited downstream use cases. Downstream projects depending on JVMCI (most notably GraalVM) must now integrate and maintain JVMCI in their own trees or stay on older JDKs; Graal compiler documentation no longer mentions JVMCI, so using Graal as a replacement for C2 is no longer supported.

Conclusion

Overall, Java 27 is a small incremental release with no major changes or new features. The good news is that its successor, Java 28, will likely include the first phase of Project Valhalla, as JEP 401 – Value Objects already has a public PR.