Oracle has released Java SE Development Kit 26.0.2, a Critical Patch Update for the JDK 26 release line. The update includes security fixes, cryptographic enhancements, certificate management improvements, time zone updates, and general bug fixes.

• Includes security vulnerability fixes delivered as part of Oracle's July 2026 Critical Patch Update.
• Establishes 26.0.2+10 as the new security baseline for the Java 26 family.
• Adds a new com.sun.security.crl.maxSize property to limit the maximum size of Certificate Revocation Lists downloaded during certificate path validation.
• The default CRL download size limit is 20 MiB and can be configured through system or security properties.
• Adds WISeKey Global GB and GC root CA certificates to the JDK trust store.

Cryptographic improvements

• Adds support for the latest ML-KEM and ML-DSA private key encodings.
• ML-KEM and ML-DSA private keys can now use PKCS #8 DER-encoded ASN.1 formats defined by the latest relevant RFC specifications.
• Introduces jdk.mlkem.pkcs8.encoding and jdk.mldsa.pkcs8.encoding security properties to control private key encoding.
• The default encoding for newly generated ML-KEM and ML-DSA private keys changes to seed.

Platform updates

• Updates IANA time zone data to version 2026b.
• Includes updated time zone behavior reflecting British Columbia's final daylight saving time transition on March 8, 2026.
• Includes additional bug fixes and reliability improvements across JDK components.

Compatibility considerations

• ML-KEM and ML-DSA private keys generated using the new default encoding may not be accepted by older JDK releases by default.
• Applications requiring compatibility with older JDK versions can configure the relevant encoding property to expandedKey.
• Organizations should test security-sensitive applications, certificate validation, cryptographic operations, and custom Java integrations before broad deployment.

Upgrade recommendation

• Oracle recommends updating JDK installations with each Critical Patch Update.
• Organizations running JDK 26.0.1 should prioritize upgrading to JDK 26.0.2 to receive the latest security fixes and security baseline.