Java 27 ships with post-quantum TLS and G1 as the universal default GC

Oracle has declared JDK 27, the reference implementation of Java 27, generally available, promoting build 35 straight from its second release candidate after the RC surfaced no priority-one bugs. The nine bundled JEPs skew toward security and runtime performance. The headline security addition is a post-quantum hybrid key exchange for TLS 1.3 (JEP 527), which pairs a classical key agreement with a quantum-resistant one so connections stay protected even if a future quantum computer breaks today’s algorithms. Two supporting cryptography features round out the theme: standardized PEM encoding and decoding for keys and certificates (JEP 538, still in preview) and in-process redaction of sensitive data in Java Flight Recorder streams (JEP 536).

On the performance side, G1 is now the default garbage collector across every environment (JEP 523), and compact object headers—which trim per-object memory overhead—are enabled by default (JEP 534) after incubating in earlier releases. The rest of the list is developer-facing language and API work still under preview or incubation, including a seventh preview of structured concurrency, a fifth preview of primitive types in pattern matching and switch, lazy constants, and the twelfth incubator round of the Vector API.

The practical significance is twofold. Post-quantum key exchange landing in the standard library means enterprises running on the JVM can begin hardening TLS against “harvest now, decrypt later” attacks without third-party libraries, and the memory and GC defaults deliver efficiency gains that most applications inherit for free on upgrade. As usual, GPL-licensed builds are available directly from Oracle, with other vendor distributions expected to follow shortly.