JDK 27 Released: Three Default Changes Boost Performance & Security Without Code Changes

On September 15, 2026, Oracle released JDK 27 (JSR 402), the reference implementation of Java SE 27. This version delivers three significant default behavior changes that provide immediate runtime benefits without code modifications, alongside six preview/incubator features targeting modern workloads.

1. G1 Becomes Default GC for All Environments (JEP 523)

Since JDK 9, G1 was the default only for server-class machines. In memory-constrained environments (small containers, embedded devices, CLI tools), the JVM fell back to Serial GC — a single-threaded collector that causes long Full GC pauses once data grows. JEP 523 makes G1 the default everywhere, eliminating the Serial GC fallback.

Developers often encounter Serial GC in small tools or batch scripts, mistaking its pauses for code problems when the real issue is the wrong collector.

Why Oracle Made This Change

Years of optimization have brought G1 to parity with Serial across all key metrics:

Throughput : Reduced synchronization overhead (JEP 522) brings G1's max throughput close to Serial.

Latency : G1 uses incremental old-generation collection instead of Serial's full stop-the-world, yielding consistently lower max pause times.

Native Memory : Recent versions reduced G1's native memory footprint to match Serial.

Startup Time : Small-heap startup overhead is now negligible.

Impact

Upgrade to JDK 27 and the JVM automatically uses G1. Applications previously suffering from Serial GC pauses in constrained environments see the problem disappear. Developers who still need extreme startup speed can explicitly request Serial GC with -XX:+UseSerialGC.

2. Compact Object Headers Enabled by Default (JEP 534)

Object headers shrink from 96 bits (12 bytes) to 64 bits (8 bytes) on 64-bit JVMs. The traditional layout consists of a 64-bit Mark Word (hash, GC age, lock state) and a 64-bit Klass Pointer (reference to class metadata). JEP 534 compresses the Klass Pointer to 32 bits because Metaspace typically stays under 4 GB, making a 32-bit index sufficient.

Result: a minimal new Object() drops from 16 bytes (12-byte header + 4-byte alignment padding) to 12 bytes (8-byte header + 4-byte padding) — a 25% heap reduction .

Why It Matters

Same memory holds more objects.

GC pressure decreases (fewer objects to scan and collect).

Data locality improves (denser objects increase CPU cache hit rates).

This change was optional in JDK 24, validated over two releases, and is now the default. No action required; upgrade and benefit immediately. Note: tools that rely on the old object header layout (some profilers) may need updates.

3. TLS 1.3 Post-Quantum Hybrid Key Exchange (JEP 527)

JDK 27 adds post-quantum hybrid key exchange algorithms to TLS 1.3, enabled by default for any application using javax.net.ssl. The hybrid approach combines a quantum-resistant algorithm with a classical one so that even if a quantum computer breaks the classical half, the post-quantum half remains secure.

Attackers already use "store now, decrypt later" — capturing encrypted traffic today to decrypt when quantum computers mature. Post-quantum protection is not a future concern; it's needed now.

New cipher suites (highest priority first):

X25519MLKEM768

SecP256r1MLKEM768

SecP384r1MLKEM1024

Existing HTTPS communication automatically gains quantum-resistant protection upon upgrading to JDK 27 — zero code changes required.

4. Lazy Constants — Third Preview (JEP 531)

Traditional static final constants initialize at class load time. If initialization is expensive (database config loading, large file parsing, ML model initialization), class loading becomes slow. Lazy constants allow deferred initialization while the JVM treats them as true constants for optimization purposes — runtime performance equals final fields.

// Traditional: eager initialization at class load
public static final List<Config> CONFIGS = loadFromDatabase();

// Lazy constant: initializes on first use
private static final LazyConstant<List<Config>> CONFIGS =
    LazyConstant.of(() -> loadFromDatabase());

public List<Config> getConfigs() {
    return CONFIGS.get(); // first call initializes, subsequent calls use cached value
}

This is especially valuable for AI/data applications where model weights, tokenizer vocabularies, and vector indexes are expensive to load but read-only thereafter.

5. Primitive Type Pattern Matching — Fifth Preview (JEP 532)

Pattern matching in switch and instanceof previously supported only reference types (String, enum, wrapper classes). Primitive types (int, long, etc.) required classic switch-case without pattern matching power. JEP 532 extends pattern matching to primitives.

// Before: only classic switch for int
switch (statusCode) {
    case 200: return "OK";
    case 404: return "Not Found";
    default: return "Unknown";
}

// JDK 27 preview: pattern matching with primitives
Object obj = getStatusCode();
return switch (obj) {
    case int i when i == 200 -> "OK";
    case int i when i == 404 -> "Not Found";
    case String s -> "String: " + s;
    default -> "Unknown";
};

The JEP also strengthens switch exhaustiveness checking, enabling the compiler to catch more errors at compile time.

6. Structured Concurrency — Seventh Preview (JEP 533)

Traditional concurrent tasks lack lifecycle binding to their parent. If the parent fails, child tasks may keep running (thread leaks); if a child fails, the parent doesn't automatically cancel siblings.

// Traditional: error handling is messy
Future<User> userFuture = executor.submit(() -> fetchUser(id));
Future<Order> orderFuture = executor.submit(() -> fetchOrder(id));
try {
    User user = userFuture.get();
    Order order = orderFuture.get();
    return new Result(user, order);
} catch (Exception e) {
    // One failed, the other still running — how to cancel?
    // Thread leak?
    throw e;
}

Structured concurrency nests child task lifecycles strictly within the parent scope:

try (var scope = new StructuredTaskScope.ShutdownOnFailure()) {
    Supplier<User> user = scope.fork(() -> fetchUser(id));
    Supplier<Order> order = scope.fork(() -> fetchOrder(id));

    scope.join();           // wait for all children
    scope.throwIfFailed();  // propagate any failure

    return new Result(user.get(), order.get());
}
// Exiting the try block automatically cancels any unfinished children

Core value: no thread leaks, no orphan tasks. Parent failure cancels all children; child failure is immediately visible to parent.

7. Vector API — Twelfth Incubation (JEP 537)

Vector API exposes SIMD (Single Instruction, Multiple Data) hardware instructions (AVX-512, ARM SVE) to Java. For matrix multiplication, vector similarity search, and other AI inference hotspots, performance gains can be orders of magnitude.

// Vector addition — processes multiple floats per instruction
FloatVector a = FloatVector.fromArray(SPECIES, arr1, i);
FloatVector b = FloatVector.fromArray(SPECIES, arr2, i);
FloatVector c = a.add(b);
c.intoArray(result, i);

On CPUs with AVX-512 or ARM SVE, Vector API directly maps Java code to hardware vector units.

8. Other Notable Improvements

JEP 536: JFR In-Process Data Sanitization — Java Flight Recorder redacts command-line arguments, environment variables, and system properties before data leaves the process, preventing accidental secret leakage during production profiling.

ML-KEM/ML-DSA Private Key Encoding Updates — Standardized post-quantum key encodings; X25519 and Ed25519 performance improvements.

JSON Thread Dumps — Thread IDs, counts, and process IDs in thread dumps are now JSON numbers, easing monitoring tool parsing.

jcmd VM.security_properties — New command to inspect active security properties at runtime.

JVMCI Removal — Legacy JVMCI options and features removed; impacts Graal JIT users (see caveats).

Pros and Cons

Pros

G1 universal default — eliminates Serial GC pauses in small-memory environments; throughput, latency, memory, and startup all match or beat Serial.

25% heap reduction via compact object headers — more objects per GB, lower GC pressure, better cache locality; large-scale apps benefit directly.

Post-quantum TLS enabled by default — zero-code upgrade gives HTTPS quantum-resistant protection; foundational security upgrade.

Lazy constants optimize AI/data workloads — expensive read-only data (model weights, vector indexes) loads on demand with final -equivalent runtime performance.

Structured concurrency eliminates thread leaks — strict parent-child lifecycle nesting makes concurrent code reliable.

JFR sanitization — production profiling no longer risks exposing secrets.

Caveats

Non-LTS release — Oracle support ends March 2027. Production systems should prefer JDK 25 LTS.

Preview/incubator features require --enable-preview — lazy constants, primitive pattern matching, structured concurrency, Vector API need explicit flag and may change in future versions.

JVMCI removed — projects using Graal JIT (which depends on JVMCI) must verify compatibility with GraalVM updates.

Compact object headers may break diagnostic tools — profilers relying on the old header layout need updates.

Applicability Guidance

Scenario Recommendations

Experimentation / learning / personal projects — Strongly recommended. Default changes immediately tangible; preview features explorable.

Small-memory containers / embedded — Strongly recommended. G1 default + compact headers improve startup and memory.

Large-scale Java applications — Recommended. 25% heap reduction, but evaluate non-LTS risk.

Security-sensitive HTTPS applications — Strongly recommended. Post-quantum crypto default, zero code change.

AI / data-intensive applications — Recommended. Lazy constants + Vector API, but preview features need assessment.

Long-term stable production — Evaluate carefully. JDK 25 LTS is safer.

Projects depending on Graal JIT — Not recommended. JVMCI removed; wait for GraalVM catch-up.

Conclusion

JDK 27 is worth trying, but production deployments should wait for JDK 28 or JDK 29 LTS. Its greatest value lies in three automatic runtime improvements:

G1 as universal default — faster startup, lower latency, no config needed.

64-bit object headers — 25% heap savings, no config needed.

Post-quantum TLS by default — quantum-resistant HTTPS, no config needed.

These are concrete, measurable gains — not "preview of a preview." Among preview features, structured concurrency (if finalized) will reshape Java concurrency patterns, and lazy constants will become standard for AI applications.

If you're on JDK 21 or JDK 25 LTS, there's no rush to upgrade. But for new projects, test environments, or getting a feel for Java's direction — JDK 27 is worth a spin.

References

JDK 27 Official Download : https://jdk.java.net/27

JEP List : https://openjdk.org/projects/jdk/27/

Oracle Java 27 Announcement : https://www.oracle.com/java/

Inside.java JDK 27 Deep Dive : https://inside.java/2026/09/15/jdk-27-available/