JDK 27: Three Default Changes That Boost Performance & Security Without Code Changes

Overview

Oracle released JDK 27 (JSR 402) on September 15, 2026. This version contains nine significant JEPs — four preview features, one incubator feature, and four final features — with three default behavior changes that provide immediate benefits without code modifications.

Key Default Behavior Changes

1. G1 Becomes Default GC for All Environments (JEP 523)

Since JDK 9, G1 was the default only for server-class machines. In memory-constrained environments (small containers, embedded devices, CLI tools), the JVM previously chose Serial GC, which suffers from long stop-the-world pauses during full collections. JEP 523 makes G1 the default everywhere because years of optimization have brought its throughput, latency, native memory usage, and startup time on par with Serial GC. G1 uses incremental old-generation collection instead of full stop-the-world pauses. Developers need not change anything; upgrading to JDK 27 automatically switches to G1. Serial GC remains available via -XX:+UseSerialGC for extreme startup-speed requirements.

2. Compact Object Headers Enabled by Default (JEP 534)

Traditional 64-bit JVM object headers occupy 96 bits (12 bytes): a 64-bit Mark Word (hash, GC age, lock state) and a 64-bit Klass Pointer (pointer to class metadata). JEP 534 compresses the Klass Pointer to 32 bits because Metaspace typically stays under 4 GB, making a 32-bit index sufficient. The header shrinks to 64 bits (8 bytes). Consequently, a minimal new Object() drops from 16 bytes to 12 bytes (8-byte header + 4-byte alignment padding) — a 25% heap reduction. This yields more objects per heap, lower GC pressure, and better CPU cache locality. The feature was optional since JDK 24 and becomes default in JDK 27.

3. Post-Quantum Hybrid Key Exchange in TLS 1.3 (JEP 527)

To counter "harvest now, decrypt later" attacks, JDK 27 adds three hybrid key-exchange algorithms that combine classical elliptic-curve cryptography with the ML-KEM (Module-Lattice-Based Key Encapsulation Mechanism) post-quantum algorithm: X25519MLKEM768 (highest priority), SecP256r1MLKEM768 , and SecP384r1MLKEM1024 . When using javax.net.ssl APIs, these algorithms activate automatically upon upgrading to JDK 27 — no code changes required. Existing HTTPS traffic gains quantum-resistant protection immediately.

Preview and Incubator Features

Lazy Constants — Third Preview (JEP 531)

Traditional static final constants initialize at class-load time, which can be expensive for database loads, large file parsing, or ML model initialization. Lazy constants defer initialization until first use while allowing the JVM to treat them as true constants for optimization (performance equivalent to final fields). Example:

// Traditional — initializes at class load
public static final List<Config> CONFIGS = loadFromDatabase();

// Lazy constant — initializes on first access
private static final LazyConstant<List<Config>> CONFIGS = 
    LazyConstant.of(() -> loadFromDatabase());

public List<Config> getConfigs() {
    return CONFIGS.get();
}

This is especially valuable for AI applications where model weights, tokenizers, and vector indexes are expensive to load but read-only thereafter.

Primitive Types in Pattern Matching — Fifth Preview (JEP 532)

Pattern matching in switch and instanceof previously supported only reference types (String, enum, wrapper classes). JEP 532 extends support to primitive types (int, long, etc.), enabling more expressive and type-safe code. The compiler also performs enhanced exhaustiveness (dominance) checking. Example:

// Before: only traditional switch-case for int
switch (statusCode) {
    case 200: return "OK";
    case 404: return "Not Found";
    default: return "Unknown";
}

// JDK 27 preview: pattern matching with primitives
Object obj = getStatusCode();
return switch (obj) {
    case int i when i == 200 -> "OK";
    case int i when i == 404 -> "Not Found";
    case String s -> "String: " + s;
    default -> "Unknown";
};

Structured Concurrency — Seventh Preview (JEP 533)

Traditional ExecutorService submissions decouple child-task lifecycles from the parent, leading to thread leaks, orphaned tasks, and complex error handling. Structured concurrency binds child-task lifecycles to a scope: if the parent fails, all children are cancelled; if a child fails, the parent can react. Example:

try (var scope = new StructuredTaskScope.ShutdownOnFailure()) {
    Supplier<User> user = scope.fork(() -> fetchUser(id));
    Supplier<Order> order = scope.fork(() -> fetchOrder(id));
    scope.join();           // wait for all children
    scope.throwIfFailed();  // propagate any failure
    return new Result(user.get(), order.get());
}
// scope auto-closes: unfinished children cancelled, no leaks

Vector API — Twelfth Incubator (JEP 537)

The Vector API exposes SIMD (Single Instruction, Multiple Data) hardware instructions (AVX-512, ARM SVE) to Java. For matrix multiplication, vector similarity, and other data-parallel operations common in AI inference and scientific computing, performance gains can be orders of magnitude. Example:

FloatVector a = FloatVector.fromArray(SPECIES, arr1, i);
FloatVector b = FloatVector.fromArray(SPECIES, arr2, i);
FloatVector c = a.add(b);
c.intoArray(result, i);

Other Notable Improvements

JEP 536: JFR In-Process Data Sanitization — JDK Flight Recorder redacts command-line arguments, environment variables, and system properties before recordings leave the process, preventing accidental secret leakage during production profiling.

ML-KEM/ML-DSA Private Key Encoding Updates — Standardized post-quantum key encodings; X25519 and Ed25519 performance improvements.

JSON Thread Dumps — Thread identifiers, counts, and process IDs emitted as JSON numbers for easier tooling parsing.

jcmd VM.security_properties — New command to inspect active security properties at runtime.

JVMCI Removal — Legacy JVMCI options and features removed; impacts Graal JIT users who must await GraalVM updates.

Pros and Cons

Advantages

G1 universal default eliminates Serial GC pauses in small-heap scenarios.

25% heap reduction via compact object headers benefits large-scale applications directly.

Post-quantum TLS enabled by default — zero-code security upgrade.

Lazy constants optimize AI/data workloads with expensive read-only initialization.

Structured concurrency prevents thread leaks and simplifies error handling.

JFR sanitization makes production profiling safer.

Caveats

JDK 27 is not an LTS release (support until March 2027); production environments should prefer JDK 25 LTS.

Preview/incubator features require --enable-preview and may change incompatibly.

JVMCI removal affects Graal JIT users.

Compact object headers may break diagnostic tools that rely on the old object layout.

Applicability Guidance

Experimentation, learning, personal projects: Strongly recommended — experience default changes and preview features early.

Small-memory containers / embedded: Strongly recommended — G1 default + compact headers improve startup and memory.

Large-scale Java applications: Recommended — 25% heap savings, but evaluate non-LTS risk.

Security-sensitive HTTPS services: Strongly recommended — post-quantum crypto activates automatically.

AI / data-intensive workloads: Recommended — lazy constants + Vector API, but preview features need evaluation.

Long-term production stability: Evaluate carefully — JDK 25 LTS is safer.

Projects using Graal JIT: Not recommended — JVMCI removed; wait for GraalVM compatibility.

Conclusion

JDK 27's greatest value lies in three automatic runtime improvements: universal G1 GC, 25% heap reduction via compact object headers, and default post-quantum TLS. These deliver tangible benefits without code changes. Among preview features, structured concurrency and lazy constants are the most impactful — if finalized, they will reshape Java concurrency and become standard for AI applications. For teams on JDK 21 or 25 LTS, there is no urgency to upgrade production, but JDK 27 is worth downloading for new projects, test environments, and exploring Java's evolution.

References

JDK 27 Official Download: https://jdk.java.net/27

JEP List: https://openjdk.org/projects/jdk/27/

Oracle Java 27 Announcement: https://www.oracle.com/java/

Inside.java JDK 27 Analysis: https://inside.java/2026/09/15/jdk-27-available/