Amazon Corretto July 2026 Quarterly Update — Downloaded All 5 Versions and Verified Operation with Docker & ECR

Introduction

On July 22, 2026, the Corretto quarterly update was released. This time, we also verified the behavior since the base OS of the Docker images is migrating to Amazon Linux 2023 (AL2023).

The target versions are six: Corretto 26, 25, 21, 17, 11, and 8. Since Corretto 26 is a Feature Release scheduled for EOL in October 2026, it is excluded from verification this time.

https://aws.amazon.com/about-aws/whats-new/2026/07/amazon-corretto-july-2026-quarterly-updates/

There are three main changes in this update.

1. Migration of the default Docker image to AL2023 base
2. Removal of JavaFX starting from Corretto 8u502
3. Security fixes for 11 OpenJDK issues + 7 OpenJFX issues (highest CVSS 7.5)

This time, we downloaded all 5 versions (8/11/17/21/25) from the official Permanent URL and verified their operation locally. As representatives, we tested Docker build and ECR Push with Corretto 25, and compared AL2023 and AL2 base images with Corretto 21.

Verification Details

Verification Environment

Verification was performed on an aarch64 Amazon Linux 2023 environment. Docker was built and run locally, and ECR uses a private repository in us-east-1.

Downloading and Verifying All Versions

Amazon Corretto's Permanent URL returns the latest release of the specified package. This time as well, it was available immediately after publication, so we could try it without waiting for Docker Hub to reflect it.

We downloaded all 5 versions in the aarch64 environment and ran java -version.

The full output for Corretto 25 as a representative example.

openjdk version "25.0.4" 2026-07-21 LTS
OpenJDK Runtime Environment Corretto-25.0.4.7.1 (build 25.0.4+7-LTS)
OpenJDK 64-Bit Server VM Corretto-25.0.4.7.1 (build 25.0.4+7-LTS, mixed mode, sharing)

Permanent URL Patterns

The base of the Permanent URL is https://corretto.aws/downloads/latest/, and binaries for each platform can be obtained using the following patterns.

# Linux x64 (tar.gz)
https://corretto.aws/downloads/latest/amazon-corretto-{VER}-x64-linux-jdk.tar.gz

# Linux aarch64 (tar.gz)
https://corretto.aws/downloads/latest/amazon-corretto-{VER}-aarch64-linux-jdk.tar.gz

# Linux x64 (rpm)
https://corretto.aws/downloads/latest/amazon-corretto-{VER}-x64-linux-jdk.rpm

# Linux x64 (deb)
https://corretto.aws/downloads/latest/amazon-corretto-{VER}-x64-linux-jdk.deb

# macOS x64
https://corretto.aws/downloads/latest/amazon-corretto-{VER}-x64-macos-jdk.tar.gz

# macOS aarch64 (Apple Silicon)
https://corretto.aws/downloads/latest/amazon-corretto-{VER}-aarch64-macos-jdk.tar.gz

# Windows x64
https://corretto.aws/downloads/latest/amazon-corretto-{VER}-x64-windows-jdk.zip

You can specify 8, 11, 17, 21, 25, or 26 for {VER}. The versions verified in this article are 8, 11, 17, 21, and 25. The verification in the above table was only performed in the aarch64 environment, and URLs for other platforms (x64/macOS/Windows) have not been verified.

Official Download Pages

The download pages for each version are as follows.

• Corretto 25
• Corretto 21
• Corretto 17
• Corretto 11
• Corretto 8

Building and Using Docker Images

As of 09:21 JST on July 23, 2026, the tags for this update had not yet been reflected on either Docker Hub or ECR Public. If you want to containerize immediately, you can obtain the binary from the Permanent URL and build it with your own Dockerfile.

Here is a summary of the status of each tag at the time of verification.

To build from the official corretto-docker repository, use the following.

docker build -t corretto-25 https://github.com/corretto/corretto-docker.git#main:25/jdk/al2023

With this update, the default Docker image base has been changed to AL2023. AL2 reached EOL on June 30, 2026, and this default change is in response to that EOL. Using Corretto 21 as an example, we compared a direct GitHub build (AL2023) with the existing tag on Docker Hub (AL2).

Since the base OS is changing from AL2 to AL2023, we recommend checking whether your Dockerfiles or applications have any dependency on the base OS.

Push the built Corretto 25 image to a private ECR. Replace <account-id> with the AWS account ID you are using.

# Create ECR repository
aws ecr create-repository \
  --repository-name corretto-25 \
  --region us-east-1 \
  --image-scanning-configuration scanOnPush=true

# Tag the local image for ECR
docker tag corretto-25:latest \
  <account-id>.dkr.ecr.us-east-1.amazonaws.com/corretto-25:25.0.4.7.1-al2023

# Log in to ECR and push
aws ecr get-login-password --region us-east-1 \
  | docker login \
    --username AWS \
    --password-stdin <account-id>.dkr.ecr.us-east-1.amazonaws.com

docker push \
  <account-id>.dkr.ecr.us-east-1.amazonaws.com/corretto-25:25.0.4.7.1-al2023

Pull from ECR and verify operation.

docker pull \
  <account-id>.dkr.ecr.us-east-1.amazonaws.com/corretto-25:25.0.4.7.1-al2023

docker run --rm \
  <account-id>.dkr.ecr.us-east-1.amazonaws.com/corretto-25:25.0.4.7.1-al2023 \
  java -version

Security Fix Summary

This update includes security fixes based on the OpenJDK Vulnerability Advisory (2026-07-21). A total of 18 vulnerabilities were fixed: 11 in OpenJDK and 7 in OpenJFX.

OpenJDK (11 issues)

The 3 issues with CVSS 7.5 all have network-accessible, unauthenticated attack vectors. All versions are affected by at least one CVE.

OpenJFX (7 issues)

Corretto 8u502 verified this time, as well as JDK versions Corretto 11 and later, do not bundle JavaFX (removed from Corretto 8 starting with u502). Therefore, these CVEs do not affect you unless you have separately installed OpenJFX. Note that the OpenJFX CVEs in this update target OpenJFX 17 and later, so please cross-reference the version of OpenJFX you are using with the affected scope in the advisory.

Confirming JavaFX Removal in Corretto 8u502

JavaFX has been removed from Corretto 8u502. This change was announced in advance via GitHub issue #569.

When searching for JavaFX-related files in the downloaded Corretto 8u502 directory, no such files were found.

find ./amazon-corretto-8.502.07.1-linux-aarch64/ \
  -name "javafx*" -o -name "jfx*" -o -name "libglass*" -o -name "libprism*"
# → No output

ls ./amazon-corretto-8.502.07.1-linux-aarch64/jre/lib/ext/ | grep -i fx
# → No matches

For migration guidance if you were using JavaFX, please refer to GitHub issue #569.

Support Calendar

※ Corretto 25 is an LTS version based on OpenJDK 25 (designated LTS release). "LTS" is also displayed in java -version. Corretto 26 is a Feature Release, and this is its final update.

For Corretto 11 and 8, the EOL dates have been extended to January 2032 and December 2030 respectively, as announced in the EOL extension announcement from October 2024.

Summary

By obtaining the binary directly from the Permanent URL, you can try the latest version without waiting for Docker Hub to reflect it. Since the default base OS of Docker images is switching from AL2 to AL2023 starting with this update, we recommend verifying early in your evaluation environment that your existing Dockerfiles and containers are not affected.