Oracle JDK 21 updates move to paid license terms on October 20

The October 20 cutoff

Oracle's quarterly Critical Patch Update on October 20, 2026 will be the first JDK 21 release published under the Java SE OTN license, the paid terms that already cover Oracle's Java 8, 11, and 17 builds. According to dev.to, Oracle made the formal announcement on August 14, 2026 and flagged the approaching deadline on its Java SE Support Roadmap.

The shift follows Oracle's one-year overlap rule, in place since 2021. JDK 21 shipped in September 2023 under the No-Fee Terms and Conditions (NFTC), which allowed free commercial and production use. When JDK 25 arrived as the next LTS release in September 2025, a twelve-month window opened; the July 21, 2026 patch, build 21.0.12, was the last free-for-production JDK 21 update. Donald Smith, Oracle's vice president of product management, wrote that the overlap exists to give users of the no-fee license time to migrate to Oracle JDK 25.

The same sequence played out for JDK 17, which moved to OTN terms with its October 15, 2024 update.

What the change does not cover

The dev.to write-up pushes back on three common misconceptions:

• Existing installs remain legal. Binaries downloaded under the NFTC keep their original terms indefinitely, including production use. The license travels with the artifact, not the calendar.
• Development stays free. The OTN license permits personal use, development, testing, prototyping, and demonstration at no cost; the fee attaches to production deployment.
• OpenJDK builds are a separate track. Only Oracle's own JDK 21 distributions are affected. Builds of OpenJDK 21 released under GPLv2 with the Classpath Exception, by Oracle or anyone else, are untouched.

The practical danger, the author argues, is automation. A Dockerfile, base image, or package manager fetching a floating Oracle JDK 21 reference will silently pull the OTN-licensed build once the October 20 update lands, with no email or dialog announcing the change.

The cost of exposure

Oracle's Java SE Universal Subscription is priced per employee rather than per server, starting at $15 per employee per month and dropping to a published floor of $5.25 at volume, according to dev.to. The article's warning is about proportionality: a single patched production host can obligate the whole company under an employee-count model, potentially producing a five-figure annual bill after an audit.

Four ways out

1. Upgrade to Oracle JDK 25, the current LTS, which stays under the NFTC until September 2028. The cost is migration effort rather than license fees, though the same cutoff will reappear for JDK 25 in 2028.
2. Switch to Eclipse Temurin 21, built from the same OpenJDK source and TCK-certified. Eclipse Adoptium's support table lists availability until at least December 2029, and migration is usually a base image or download URL change.
3. Switch to Amazon Corretto 21, which offers the longest free runway: a last planned update in July 2030 and end of life in October 2030, under GPLv2 with the Classpath Exception at no cost.
4. Freeze on build 21.0.12. Legal and free, but the build stops receiving security fixes, so every CVE disclosed after October 20 goes unpatched. The article frames this as a short-term holding pattern, not a strategy.

On RHEL, the Red Hat build of OpenJDK 21 adds a fifth option, with support through December 2029 folded into an existing subscription.

What to do before October 20

The dev.to piece recommends auditing the build vendor rather than just the version, since a version check does not reveal who compiled the binary. Teams should search Dockerfiles, Helm charts, base image registries, and package automation for Oracle JDK 21 download URLs, then either pin Oracle environments to 21.0.12 or repoint them at Temurin, Corretto, or JDK 25. Whatever the choice, the cycle repeats: JDK 29 arrives in September 2027, and JDK 25's free window closes around September 2028.

Why it matters

This is not a one-off event but a structural feature of Oracle's Java release model: every LTS loses its permissive license one year after its successor ships, and the change arrives quietly through build numbers rather than notifications. Teams with automated, unpinned update paths face the largest risk, because one routine patch can pull an OTN-licensed binary into production and trigger per-employee subscription pricing. Moving to a non-Oracle OpenJDK distribution such as Temurin or Corretto provides the same certified platform with longer free support windows and decouples the security update cadence from Oracle's licensing calendar. Java shops that treat October 20 as a deadline to inventory their JDK vendors will also be better prepared for the same cliff in September 2028.