Amazon Corretto July 2026 Quarterly Update — I Downloaded All 5 Versions and Verified They Work with Docker & ECR

Introduction

On July 22, 2026, the Corretto quarterly update was released. Since the base OS of the Docker images is migrating to Amazon Linux 2023 (AL2023) in this release, I also verified how that behaves.

The targets are six versions: Corretto 26, 25, 21, 17, 11, and 8. Corretto 26 is a Feature Release scheduled to reach EOL in October 2026, so it is excluded from this verification.

https://aws.amazon.com/about-aws/whats-new/2026/07/amazon-corretto-july-2026-quarterly-updates/

There are three main changes in this release.

1. Migration of the default Docker images to an AL2023 base
2. Removal of JavaFX from Corretto 8u502
3. Security fixes for 11 OpenJDK issues + 7 OpenJFX issues (highest CVSS 7.5)

This time, I downloaded all 5 versions (8/11/17/21/25) from the official Permanent URLs and verified them locally. As representatives, I verified the Docker build and ECR push with Corretto 25, and the comparison of AL2023 and AL2 base images with Corretto 21.

Verification Details

Verification Environment

I verified on an aarch64 Amazon Linux 2023 environment. Docker was built and run locally, and ECR used a private repository in us-east-1.

Downloading and Verifying All Versions

Amazon Corretto's Permanent URL returns the latest release of the specified package. This time too, it was available immediately after release, so I could try it without waiting for Docker Hub to be updated.

I downloaded all 5 versions on the aarch64 environment and ran java -version.

Here is the full output for Corretto 25 as a representative.

openjdk version "25.0.4" 2026-07-21 LTS
OpenJDK Runtime Environment Corretto-25.0.4.7.1 (build 25.0.4+7-LTS)
OpenJDK 64-Bit Server VM Corretto-25.0.4.7.1 (build 25.0.4+7-LTS, mixed mode, sharing)

Permanent URL Patterns

The base of the Permanent URL is https://corretto.aws/downloads/latest/, and you can obtain binaries for each platform with the following patterns.

# Linux x64 (tar.gz)
https://corretto.aws/downloads/latest/amazon-corretto-{VER}-x64-linux-jdk.tar.gz

# Linux aarch64 (tar.gz)
https://corretto.aws/downloads/latest/amazon-corretto-{VER}-aarch64-linux-jdk.tar.gz

# Linux x64 (rpm)
https://corretto.aws/downloads/latest/amazon-corretto-{VER}-x64-linux-jdk.rpm

# Linux x64 (deb)
https://corretto.aws/downloads/latest/amazon-corretto-{VER}-x64-linux-jdk.deb

# macOS x64
https://corretto.aws/downloads/latest/amazon-corretto-{VER}-x64-macos-jdk.tar.gz

# macOS aarch64 (Apple Silicon)
https://corretto.aws/downloads/latest/amazon-corretto-{VER}-aarch64-macos-jdk.tar.gz

# Windows x64
https://corretto.aws/downloads/latest/amazon-corretto-{VER}-x64-windows-jdk.zip

You can specify 8, 11, 17, 21, 25, or 26 for {VER}. The versions verified in this article are 8, 11, 17, 21, and 25. The verification in the table above was performed only on the aarch64 environment, and the URLs for other platforms (x64/macOS/Windows) are unverified.

Official Download Pages

The download page for each version is here.

• Corretto 25
• Corretto 21
• Corretto 17
• Corretto 11
• Corretto 8

Building and Using Docker Images

As of 09:21 JST on July 23, 2026, the tags for this update had not yet been reflected on either Docker Hub or ECR Public. If you want to containerize right away, you can obtain the binaries from the Permanent URLs and build with your own Dockerfile.

Here is a summary of the status of each tag at the time of checking.

To build from the official corretto-docker repository, do the following.

docker build -t corretto-25 https://github.com/corretto/corretto-docker.git#main:25/jdk/al2023

In this update, the default Docker images were changed to an AL2023 base. AL2 reached EOL on June 30, 2026, and this default change is a response to that EOL. Using Corretto 21 as an example, I compared a direct build from GitHub (AL2023) with the existing tag on Docker Hub (AL2).

Because the base OS changes from AL2 to AL2023, we recommend checking whether your Dockerfiles and applications depend on the base OS.

Push the built Corretto 25 image to a private ECR repository. Replace <account-id> with the AWS account ID you are using.

# Create ECR repository
aws ecr create-repository \
  --repository-name corretto-25 \
  --region us-east-1 \
  --image-scanning-configuration scanOnPush=true

# Tag the local image for ECR
docker tag corretto-25:latest \
  <account-id>.dkr.ecr.us-east-1.amazonaws.com/corretto-25:25.0.4.7.1-al2023

# Log in to ECR and push
aws ecr get-login-password --region us-east-1 \
  | docker login \
    --username AWS \
    --password-stdin <account-id>.dkr.ecr.us-east-1.amazonaws.com

docker push \
  <account-id>.dkr.ecr.us-east-1.amazonaws.com/corretto-25:25.0.4.7.1-al2023

Pull from ECR and verify it works.

docker pull \
  <account-id>.dkr.ecr.us-east-1.amazonaws.com/corretto-25:25.0.4.7.1-al2023

docker run --rm \
  <account-id>.dkr.ecr.us-east-1.amazonaws.com/corretto-25:25.0.4.7.1-al2023 \
  java -version

Overview of Security Fixes

This update includes security fixes based on the OpenJDK Vulnerability Advisory (2026-07-21). A total of 18 vulnerabilities were fixed: 11 in OpenJDK and 7 in OpenJFX.

OpenJDK (11 issues)

All three CVSS 7.5 issues have network-based, no-authentication-required vectors. Every version is affected by at least one CVE.

OpenJFX (7 issues)

JavaFX is not bundled with Corretto 8u502 verified here, nor with the JDKs of Corretto 11 and later (in Corretto 8, it was removed starting with u502). Therefore, unless you have installed OpenJFX separately, you are not affected by these CVEs. Note that the OpenJFX CVEs this time target OpenJFX 17 and later, so please check the OpenJFX version you use against the affected range in the advisory.

Confirming JavaFX Removal in Corretto 8u502

JavaFX was removed from Corretto 8u502. This change had been announced in advance in GitHub issue #569.

I searched for JavaFX-related files in the directory of the downloaded Corretto 8u502, and no matching files existed.

find ./amazon-corretto-8.502.07.1-linux-aarch64/ \
  -name "javafx*" -o -name "jfx*" -o -name "libglass*" -o -name "libprism*"
# → No output

ls ./amazon-corretto-8.502.07.1-linux-aarch64/jre/lib/ext/ | grep -i fx
# → No match

If you were using JavaFX, see GitHub issue #569 for migration.

Support Calendar

• Corretto 25 is an LTS version based on OpenJDK 25 (an LTS-designated release). java -version also displays "LTS". Corretto 26 is a Feature Release, and this is its final update.

For Corretto 11 and 8, the October 2024 EOL extension announcement extended them to January 2032 and December 2030, respectively.

Summary

If you obtain the binaries directly from the Permanent URLs, you can try the latest versions without waiting for Docker Hub to be updated. Starting with this release, the default base OS of the Docker images switches from AL2 to AL2023, so we recommend checking early in a test environment whether your existing Dockerfiles and container behavior are affected.