I Tried Out the Amazon Corretto October 2026 Quarterly Update
This page has been translated by machine translation. View original
Introduction
On October 22, 2026, the Amazon Corretto quarterly update was announced.
The previous quarterly update, in July, is covered in the article below.
This time, I pulled the latest images of 8 / 11 / 17 / 21 / 25 / 27 from ECR Public and confirmed that they start up, and I also verified the behavior of the TLS 1.3 hybrid key exchange (JEP 527) that was backported to 25.
Pulling from ECR Public and Verifying Startup
Pulling the Images
Corretto images are available at public.ecr.aws/amazoncorretto/amazoncorretto on ECR Public. Specify the major version as the tag. I used the following commands to pull and verify startup for 25. No login was required.
docker pull public.ecr.aws/amazoncorretto/amazoncorretto:25
docker run --rm public.ecr.aws/amazoncorretto/amazoncorretto:25 java -version
The output of java -version shows that the version of the pulled image is 25.0.5.0.9.
openjdk version "25.0.5" 2026-10-20 LTS
OpenJDK Runtime Environment Corretto-25.0.5.0.9 (build 25.0.5+9-LTS)
OpenJDK 64-Bit Server VM Corretto-25.0.5.0.9 (build 25.0.5+9-LTS, mixed mode, sharing)
Startup Verification Results
On October 30, 2026, on Linux aarch64, I pulled the six tags using the same procedure and ran java -version. All six started up normally. The following table shows the Runtime line of each output with the leading OpenJDK Runtime Environment removed.
| Tag | Runtime line |
|---|---|
| 8 | Corretto-8.512.08.1 (build 1.8.0_512-b08) |
| 11 | Corretto-11.0.33.0.9 (build 11.0.33+9-LTS) |
| 17 | Corretto-17.0.21.0.10 (build 17.0.21+10-LTS) |
| 21 | Corretto-21.0.13.0.10 (build 21.0.13+10-LTS) |
| 25 | Corretto-25.0.5.0.9 (build 25.0.5+9-LTS) |
| 27 | Corretto-27.0.1.0.10 (build 27.0.1+10-FR) |
Verifying TLS Hybrid Key Exchange (JEP 527)
CHANGELOG Entry
I verified JEP 527 using Corretto 27 in the September article.
The Corretto 25 CHANGELOG has a section for 25.0.5.0.9 (Release Date: October 20, 2026). That section lists JDK-8314323 "Implement JEP 527: TLS 1.3 Hybrid Key Exchange".
Test Environment
The server's Dockerfile.server and the client's PqTlsCheck.java are based on the ones used in the September article. For the full code, please refer to the September article.
I prepared the server as a container with --network host. Inside the container, OpenSSL's s_server is started on port 4433 with only TLS 1.3 enabled. The output of openssl version was as follows.
OpenSSL 3.5.7 9 Jun 2026 (Library: OpenSSL 3.5.7 9 Jun 2026)
The client was run with the image of 25 pulled from ECR Public. I compiled PqTlsCheck.java with javac and ran it with java from the same image. To output the handshake debug log, I added -Djavax.net.debug=ssl:handshake at runtime.
mkdir -p work-tmp/cls
docker run --rm --user "$(id -u):$(id -g)" -v "$PWD/artifacts:/src:ro" -v "$PWD/work-tmp/cls:/cls" public.ecr.aws/amazoncorretto/amazoncorretto:25 javac -d /cls /src/PqTlsCheck.java
docker run --rm --network host -v "$PWD/work-tmp/cls:/cls:ro" public.ecr.aws/amazoncorretto/amazoncorretto:25 java -Djavax.net.debug=ssl:handshake -cp /cls PqTlsCheck localhost 4433
PqTlsCheck.java is code for verification only, with certificate validation disabled. Do not use it in applications.
Verification Results
No settings such as jdk.tls.namedGroups were specified on the client-side Java. On Linux aarch64, I connected once to OpenSSL 3.5.7's s_server and checked the ClientHello and ServerHello in the debug log.
X25519MLKEM768 is the group (the named group in the debug log) used for TLS 1.3 hybrid key exchange. In the ClientHello, X25519MLKEM768 came first in both supported_groups and the client_shares of key_share.
"supported_groups (10)": {
"named groups": [X25519MLKEM768, x25519, secp256r1, secp384r1, secp521r1, x448, ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192]
},
"key_share (51)": {
"client_shares": [
{
"named group": X25519MLKEM768
The named group selected in the ServerHello's key_share was also X25519MLKEM768.
"ServerHello": {
"cipher suite" : "TLS_AES_256_GCM_SHA384(0x1302)",
"extensions" : [
"supported_versions (43)": {
"selected version": [TLSv1.3]
},
"key_share (51)": {
"server_share": {
"named group": X25519MLKEM768
The following is an excerpt of the output of PqTlsCheck.
Protocol: TLSv1.3
CipherSuite: TLS_AES_256_GCM_SHA384
SUCCESS: TLS handshake completed.
Summary
The Amazon Corretto October 2026 quarterly update has been released as scheduled.
For details on the updates for each version, please check the CHANGELOG of each version.
Quarterly updates also include bug fixes and other changes. We recommend keeping up with updates in a planned manner.
