Oracle JDK 21 Free Updates End: The Deadline Is a Patch Date

Oracle’s Java SE support roadmap, updated 4 August 2026, says that update releases of Oracle JDK 21 published after September 2026 are planned to ship under the Java SE OTN license, the paid one, same as 8, 11, and 17 today.

That sentence has no day attached to it, and people keep inventing one. The date that matters is not on a calendar page, it is on Oracle’s patch schedule. Oracle ships JDK updates on the quarterly Critical Patch Update cycle, the third Tuesday of January, April, July, and October. July’s landed 21 July 2026 as 21.0.12. The next one is 20 October 2026.

So 21.0.12 is the last Oracle JDK 21 build you can put in production for free. The one after it costs money.

The JDK 17 precedent says exactly this. Oracle’s roadmap records that 17’s permissive updates ran “through September of 2024,” and then that “further update releases of Oracle JDK 17, released as of October 15, 2024” were OTN. October 15, 2024 was that quarter’s patch Tuesday.

Nothing expires, nothing phones home

The binaries you already have keep working forever under the terms they shipped with. There is no kill switch, no license check at startup, no countdown to an outage. 21.0.12 stays yours.

What changes is the license attached to the next patch. Which is a stranger kind of deadline, because you can sail past it without noticing anything at all, right up until a CVE lands and applying the fix becomes a purchase order.

The subscription is priced per employee

Oracle’s Java SE Universal Subscription price list is still the document dated 1 March 2023. The metric is Employee, and the definition on that PDF is worth reading in full before anyone in your org quotes a number:

all of Your full-time, part-time, temporary employees, and all of the full-time employees, part-time employees and temporary employees of Your agents, contractors, outsourcers, and consultants that support Your internal business operations.

Then, in case that left room: “The quantity of the licenses required is determined by the number of Employees and not just the actual number of Employees that use the Programs.”

Employees	Per employee / month	Annual, at that band’s floor
1 to 999	$15.00	$18,000 at 100 people
1,000 to 2,999	$12.00	$144,000
3,000 to 9,999	$10.50	$378,000
10,000 to 19,999	$8.25	$990,000
20,000 to 29,999	$6.75	$1,620,000
30,000 to 39,999	$5.70	$2,052,000
40,000 to 49,999	$5.25	$2,520,000
50,000+	Contact Oracle

A 500-person company with twelve Java developers pays $90,000 a year. The same document caps you at 50,000 Processors under this metric, desktops and laptops excluded, above which you need a separate license.

One reason to buy that used to be real and no longer is. The roadmap now states that GraalVM for JDK 24 was the final version licensed and supported as part of Oracle Java SE products, so “we need the subscription for GraalVM Enterprise” is not a live argument in 2026. What is left is Oracle’s support contract itself, and regulated environments where a named vendor on the runtime is a line item somebody signs off on.

Change the vendor, keep the version

This is the answer for most teams, and it is the one the subscription-selling comparison posts put in section five.

Other OpenJDK builds are TCK-certified and functionally equivalent for ordinary server workloads, they are free, and several of them patch JDK 21 for years past Oracle’s window: Temurin to December 2029, Corretto to October 2030, Zulu to September 2031, Liberica to March 2032. All four shipped a 21.0.12 build in the same July cycle Oracle did.

Usually it is one line:

# from
FROM eclipse-temurin:21-jre        # or openjdk:21, or an Oracle JDK image
# to
FROM amazoncorretto:21-headless

The version number does not move. The vendor string does, which is how you check the swap took:

$ java -version
openjdk version "21.0.12" 2026-07-21 LTS
OpenJDK Runtime Environment Corretto-21.0.12.9.1 (build 21.0.12+9-LTS)

Corretto is the default if you are on AWS, since it is what Lambda and Amazon Linux ship. Temurin sits under the Eclipse Foundation, which is the argument if you would rather no single company own your runtime. Zulu and Liberica give the longest free windows.

Where it is not drop-in: JavaFX is bundled differently across distributions (Liberica Full has it, Temurin does not), Oracle’s commercial Flight Recorder integrations differ, and some ERP and banking middleware names Oracle JDK specifically in its support matrix. Check that matrix before the swap, not after.

Or move to 25, and understand what you are renting

JDK 25 shipped September 2025 under the same no-fee terms. Oracle has not published the date those terms end, but the pattern is consistent for both 17 and 21: free until one year after the next LTS. The roadmap puts Java 29 in September 2027, which points at September 2028.

The hop from 21 is small. The 32-bit x86 port was removed in 25, GTK2 went with it, a batch of deprecated JVM flags and old JMX system properties are gone, and the Unicode and CLDR updates plus COMPAT locale removal are the ones most likely to surface as a quietly wrong date in an invoice. For a typical Spring or Quarkus service the work is bump the base image, run the suite, fix zero to three things.

Note that 25 is no longer the newest thing: JDK 26 went GA in March 2026 and JDK 27 arrives this September, both non-LTS. Chasing those means a feature-release upgrade every six months, which is a real strategy but a different one.

The catch with 25 is that September 2028 brings you back to this same page. You are renting free-ness two years at a time from a vendor whose commercial interest is that you eventually stop.

If you are on 17, this already happened to you

Oracle JDK 17 updates went OTN on 15 October 2024. If you have been pulling Oracle JDK 17 patches since then without a subscription, the exposure is twenty-two months old, not eight weeks away.

Premier Support for 17 also ends this September. Extended Support runs to September 2029, and here the roadmap footnote is better news than most write-ups suggest: the Extended Support fee is waived for October 2026 through September 2029 for Java SE 17. Same waiver exists for 11 through January 2032 and 8 through December 2030.

The 17 to 21 jump is harder than 21 to 25, and one change accounts for most of it. JEP 400 made UTF-8 the default charset in JDK 18. Code calling new String(bytes), FileReader, or PrintWriter without an explicit charset changed behavior, and on Windows that means Windows-1252 silently became UTF-8. It surfaces as mangled characters in a CSV export, not as a compile error. After that: tightened encapsulation of JDK internals, which older Lombok, Hibernate, and bytecode-manipulation libraries trip over, and generational ZGC, where your 17-era tuning may not hold. OpenRewrite has recipes for the mechanical part, though it will not find the charset bugs.

Find out what you actually run

Before any of the above, get the inventory. Not what you believe is installed:

# container images
docker images --format '{{.Repository}}:{{.Tag}}' | grep -iE 'jdk|jre|java|corretto|temurin|zulu'

# hosts
find / -name 'release' -path '*jdk*' 2>/dev/null | xargs grep -h IMPLEMENTOR

The output of that second command is also the artifact that makes an Oracle audit boring instead of expensive, so keep the download URLs, checksums, and dates alongside it.

If Oracle’s licensing team has already contacted you, stop here and talk to counsel before you change any deployment. Changing your footprint mid-audit is not a blog-post decision.