Java 11

Apply this baseline to Java SE 11 applications and libraries. Revalidate data whenever it enters from a caller, external system, persistent store, plug-in, reflective adapter, or other component with different trust assumptions.

Version and execution environment

• Deploy your vendor's newest Java 11 security update and record the vendor and complete runtime build. Rebuild containers, custom jlink runtime images, and self-contained installers whenever the vendor ships a Java 11 security update, which can arrive between the quarterly Critical Patch Updates as well as with them. Build images from a tag that follows the Java 11 line and rebuild them with docker build --pull, or pin a digest that an update bot keeps current. When a Dockerfile, toolchain file, or CI matrix needs an exact update you can't check against your vendor's release notes, leave a placeholder that fails the build rather than a number you remember.
• Check the runtime separately from dependencies, because dependency scanners don't see the JDK: scan built images with a container scanner, and have CI run java -version in the image and fail when your vendor lists a newer Java 11 security update.
• Verify the distributor's support window, platform matrix, update channel, and license independently. Oracle's support dates and update terms do not establish patch availability for every OpenJDK distribution.
• Compile with javac --release 11 and run tests on the same vendor build used in production. Do not rely on -source and -target alone, which can still expose APIs absent from Java 11.
• Keep