Java 27

Apply these rules to Java SE 27 applications on JDK 27. Apply the relevant framework and database-driver security rules in addition to this language and runtime baseline.

Runtime and build boundaries

• Deploy a supported vendor build of JDK 27 for the actual operating system and architecture; exclude early-access builds from production.
• Plan migration before the vendor stops updating this non-LTS line; Oracle's Java 27 Premier Support ends in March 2027 when the next feature release supersedes it.
• Run your vendor's newest JDK 27 security update on every deployed runtime and record its vendor and build. Rebuild and redistribute containers, bundled applications, and custom jlink images whenever the vendor ships a JDK 27 security update, which can arrive between the quarterly Critical Patch Updates as well as with them. Build images from a tag that follows the JDK 27 line and rebuild them with docker build --pull, or pin a digest that an update bot keeps current. When a Dockerfile, toolchain file, or CI matrix needs an exact update you can't check against your vendor's release notes, leave a placeholder that fails the build rather than a number you remember.
• Check the runtime separately from dependencies, because dependency scanners don't see the JDK: scan built images with a container scanner, and have CI run java -version in the image and fail when your vendor lists a newer JDK 27 security update.
• Budget -Xmx and -XX:MaxDirectMemorySize within the process memory limit, leaving headroom for stacks, metaspace, and other native allocations.
• Compile for