Oracle JDK 21 license: from 21.0.13, no longer free for all

The Oracle JDK 21 license changed on 20 October 2026. Oracle's JDK 21 release notes say 21.0.13 "is the first JDK 21 update release made available under the" OTN License for Java SE, which allows personal and development use at no cost. If your servers pull Oracle builds automatically, check what they pulled last week. By the end of this post you will know what Oracle's text actually says, why freezing on the last free build is not safe, and what each of the three exits costs you.

Date (2026)	Oracle JDK 21 release	What Oracle says about it
21 July	21.0.12	NFTC; Oracle's licensing FAQ lists "21.0.12 and earlier" as NFTC
18 August	21.0.12.1	Security update; carries the same "Availability under NFTC" notice
20 October	21.0.13	First JDK 21 update under OTN for Java SE
21 October	21.0.13.0.2	Respin for a TLS vulnerability
24 October	21.0.13.0.3	Second respin, current security baseline
17 November	Next security release	Oracle advises against running 21.0.13.x after this date

Every row comes from the consolidated JDK 21 release notes, apart from the FAQ wording, which is from the Oracle Java SE Licensing FAQ. Nothing here is legal advice. It is what Oracle's published text says, and you should confirm your own license position against the agreement you actually accepted.

What the Oracle JDK 21 license says from 21.0.13 onward

The 21.0.13 release note is short. It says the OTN for Java SE license "is substantially different from the Oracle No-fee Terms and Conditions (NFTC) used in earlier JDK 21 updates," and that it "permits certain uses, such as personal use and development use, at no cost, but other uses authorized under the NFTC may no longer be available." It adds that a similar change applies to JavaFX 21 updates released after September 2026.

The difference between NFTC and OTN is the whole story. The licensing FAQ says the NFTC "permits free use for all users – even commercial and production use," with no click-through, so automated downloads were easy. The same FAQ lists the no-cost OTN uses: personal use on a desktop or laptop; development, testing, prototyping and demonstrating; use with approved "Schedule A" and "Schedule B" products such as Oracle SQL Developer; and use with identified Oracle Cloud Infrastructure products.

Is Oracle JDK 21 free for commercial use?

Oracle JDK 21.0.13 and later is not free for every user. The Java SE Support Roadmap says Oracle JDK releases for Java 8, 11, 17 and 21 are available under the OTN license, "which is free for Personal, Development and other Users only." The FAQ is blunt about one edge case: using Java on a laptop "as part of any business operations" is not personal use. For anything outside the listed uses, Oracle points you to a Java SE Universal Subscription.

Oracle's own pages disagree on where the free line falls

Oracle draws the line in two ways. The release notes and roadmap use a date: updates "after September of 2026" switch to OTN, and the roadmap names "Oracle JDK 21 releases as of October 20, 2026." The FAQ's license table uses a version: NFTC for "releases through September 2026 (21.0.12 and earlier)."

Those two rules disagree about 21.0.12.1, which Oracle shipped on 18 August 2026. By date it sits inside the NFTC window, and its release note still carries the "Availability of Oracle JDK 21 under NFTC" notice. By version number it comes after 21.0.12. Oracle's pages never state 21.0.12.1's license outright. The roadmap adds a third wrinkle: one sentence says Java SE 21 public updates "through September 2025" were permissively licensed, while the next sentence in the same paragraph gives 20 October 2026. That looks like a typo, but it is on the page.

Popular coverage does not settle it. Redress Compliance, a licensing consultancy, says "the free window closed on September 16, 2026" and that "the last permissively licensed build was 21.0.12." Oracle's text says "after September 2026," not 16 September, and Redress's page, published on 26 August, does not mention the 21.0.12.1 build that shipped eight days earlier. We go with Oracle's wording. If 21.0.12.1 is in your estate and the license matters for an audit, ask Oracle or your licensing advisor in writing.

One more line in the FAQ matters for anyone holding old binaries: "You may continue to use releases you have downloaded under the terms of the license under which you downloaded them." The license follows the build you downloaded, not the major version.

Freezing on 21.0.12.1 is not a safe hold

Staying on the last NFTC build trades a license problem for a security one. The October 2026 Critical Patch Update contains 55 new security patches for Oracle Java SE, and Oracle says 49 of them "may be remotely exploitable without authentication." By our count of that advisory's risk matrix, 38 of the 55 CVEs list Oracle Java SE 21.0.12.1 as affected, 33 of those are remotely exploitable without authentication, and the highest base score among them is 7.0.

The following week was worse. The OpenJDK advisory of 21 October fixed CVE-2026-91403, a javax.net.ssl flaw scored 9.1 that affects 21.0.13 and earlier. The advisory of 24 October fixed CVE-2026-114820, also javax.net.ssl and also 9.1, which affects 21.0.13.0.2 and earlier. Oracle's 21.0.13.0.3 contains the second fix. So the October 20 build is already two respins out of date.

The cadence is now monthly. The CPU advisory says security patches ship "on the third Tuesday of each month," with the next four on 17 November 2026, 15 December 2026, 19 January 2027 (a full CPU) and 16 February 2027. If you are deciding which CVEs to patch first, two 9.1 TLS bugs in the runtime belong near the top.

Three routes: an OpenJDK build, JDK 25, or paying Oracle

Route	License cost	Engineering cost	Runway
Switch to an OpenJDK 21 build	None for the builds listed below	Swap the runtime, retest, change images	Vendor-specific, 2028 to 2030
Upgrade to Oracle JDK 25	NFTC until September 2028	A feature-release upgrade and full regression	The same cliff in September 2028
Buy a Java SE Universal Subscription	Quote from Oracle	None	Premier Support to September 2028

Switch from Oracle JDK to Temurin, Corretto or Microsoft's build

OpenJDK builds are not Oracle JDK, and Oracle's own OpenJDK 21 builds will not help: the FAQ lists them as available only for releases through January 2024. Third-party builds have moved to 21.0.13, with dates taken from each vendor's own page:

Build	Latest JDK 21 release seen on 26 October	Vendor-stated support
Eclipse Temurin	jdk-21.0.13+9, published 22 October	At least December 2029
Amazon Corretto	21.0.13.0.10, 20 October	End of life October 2030
Microsoft Build of OpenJDK	21.0.13.0.2	Earliest end of support September 2028
Azul Zulu	21.0.13 (build 9), built 21 October	Check Azul's terms of use

Amazon says it "does not charge for its use or distribution" of Corretto, and Microsoft says its quarterly updates "are free of charge and available to anyone." Both state TCK testing. The catch is in the version column. Corretto's trailing ".0.10" is its own build numbering, and its changelog gives the base as OpenJDK 21.0.13+9. Microsoft links all three October advisories from its 21.0.13.0.2 notes, even though the 24 October advisory lists upstream 21.0.13.0.2 as affected. Read the notes, not the number: search each vendor's release notes for CVE-2026-91403 and CVE-2026-114820 before you treat a build as current.

Upgrade Java 21 to Java 25

Oracle's suggested route is JDK 25. The roadmap says users who want permissive licensing "should move to Oracle JDK 25 or later." That buys two years, not a permanent fix: the FAQ says JDK 25 updates stay on NFTC "until September of 2028, one year after the release JDK 29 LTS," and then move to OTN. If you upgrade to JDK 25 on Oracle builds, put September 2028 in the roadmap now. Choosing a runtime target against a vendor's license calendar is the same exercise as picking a .NET upgrade target, and the same rule applies: pick the date you can live with, not the newest number.

Pay Oracle for a Java SE Universal Subscription

Paying is the right answer if you depend on Oracle support or certification, or cannot retest before 17 November. Oracle sells the Universal Subscription through the Oracle Store and its sales team, and its subscription page mentions simplified pricing for organizations with fewer than 3,000 employees. We have not quoted a price here because we did not find one on an Oracle page. Get a written quote. Customers keep Premier Support for Java 21 until September 2028 and Extended Support until September 2031, according to the roadmap.

Stop automatic Oracle JDK updates in production this week

Most exposure comes from automation, not decisions. Oracle described the NFTC as having "no click through license," which is why scripts, Dockerfiles and golden images pull Oracle builds without anyone choosing to. The practical steps:

1. Inventory every runtime and base image and record vendor and version. Oracle says Java Management Service is "available to all users" for finding Java versions on your systems.
2. Pin the vendor and version in your CI/CD pipeline so a scheduled rebuild cannot pull 21.0.13 from Oracle without anyone noticing.
3. Pick a route for each application, then retest TLS paths against whichever build carries both October TLS fixes.
4. Check vendor-supplied applications. The FAQ says a vendor with an Oracle ISV agreement may already cover your Java use, so ask them.

Pinning images and controlling rebuilds is standard CI/CD implementation work, and it is the cheapest of these steps. If the JDK question is one of several Oracle dependencies, it belongs in the same review as the database; our Oracle to MariaDB migration post covers that side. For larger estates, our legacy application modernization team runs that review as one engagement.

The next deadline is 17 November 2026. That is the next security release, and after it Oracle advises against running any 21.0.13 build. Have a route chosen for each application before then, because whichever one you pick, you will be patching on it the following month.