--- title: Announcing Oracle Jipher 10.37: FIPS 140-3 Cryptography... description: Oracle Jipher 10.37 updates the packaged OpenSSL FIPS module to 3.5.7, fixing CVE-2026-42770 and correcting an AES-KWP unwrap output buffer size issue. The... canonical: https://daily.dev/posts/announcing-oracle-jipher-10-37-fips-140-3-cryptography-for-java-bihfps62i twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Announcing Oracle Jipher 10.37: FIPS 140-3 Cryptography for Java | daily.dev og:description: Oracle Jipher 10.37 updates the packaged OpenSSL FIPS module to 3.5.7, fixing CVE-2026-42770 and correcting an AES-KWP unwrap output buffer size issue. The... og:url: https://daily.dev/posts/announcing-oracle-jipher-10-37-fips-140-3-cryptography-for-java-bihfps62i og:image: https://api.daily.dev/og/posts/biHFPs62i.png og:image:alt: Announcing Oracle Jipher 10.37: FIPS 140-3 Cryptography for Java og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Announcing Oracle Jipher 10.37: FIPS 140-3 Cryptography for Java **[Inside Java](https://daily.dev/sources/inside_java)** · 3 min read · 0 upvotes · 0 comments ## Summary Oracle Jipher 10.37 updates the packaged OpenSSL FIPS module to 3.5.7, fixing CVE-2026-42770 and correcting an AES-KWP unwrap output buffer size issue. The release also carries forward 10.36's stricter FIPS 140-3 compliance changes: DSA key/signature generation removed, TLS 1.2 key derivation now requires Extended Master Secret, Triple DES key generation and encryption removed, tighter RSA-PSS and PBKDF2 restrictions, and deprecation of DHFIPSParameterSpec and JipherJCE.isFipsValid(). Jipher 10.37 is the last release supporting GraalVM for JDK 17 and 21; customers needing FIPS certification on GraalVM should migrate to Oracle JDK. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What changed in Oracle Jipher 10.37 and does it fix a CVE? Oracle Jipher 10.37 updates the patched OpenSSL FIPS module to version 3.5.7, incorporating the fix for CVE-2026-42770, and corrects the size of the output buffer used to receive AES-KWP unwrap output. It supports Oracle JDK 17 and 21 plus GraalVM for JDK 17 and 21 on Oracle Linux and Red Hat Linux 8, 9, and 10. _Track cryptography CVE fixes like this one for Java FIPS deployments on daily.dev._ ### Does Oracle Jipher still support DSA and Triple DES key generation after the FIPS 140-3 update? No, as of the Jipher 10.36 FIPS 140-3 compliance update, DSA key and signature generation and Triple DES key generation and encryption are no longer supported. Existing DSA keys can still be imported with signature verification available under default enforcement policy, and existing Triple DES keys can still be decrypted under default policy, but new key generation for both is removed. _Developers migrating FIPS-regulated Java apps can follow algorithm restriction changes like these on daily.dev._ ### Is GraalVM still supported for FIPS-certified Java workloads with Oracle Jipher? Jipher 10.37 is the last planned update release supporting GraalVM for JDK 17 and GraalVM for JDK 21. Oracle Java SE customers running FIPS-certification workloads on GraalVM are advised to transition to Oracle JDK instead, with Oracle Support available for migration assistance. _Teams planning a GraalVM to Oracle JDK migration for FIPS compliance can follow updates like this on daily.dev._ ## Similar posts on daily.dev - [JDK 24 Security Enhancements](https://daily.dev/posts/jdk-24-security-enhancements-tln02dr7b) · Baeldung · 0 upvotes · 0 comments - [Post-Quantum Cryptography in Long-Term Support JDK Releases](https://daily.dev/posts/post-quantum-cryptography-in-long-term-support-jdk-releases-cm66jvqjw) · Inside Java · 0 upvotes · 0 comments - [FIPS 140-3 support in OpenSearch](https://daily.dev/posts/fips-140-3-support-in-opensearch-i7zurfqul) · OpenSearch · 0 upvotes · 0 comments - [Everything you need to know about FIPS 140-3 on Ubuntu](https://daily.dev/posts/everything-you-need-to-know-about-fips-140-3-on-ubuntu-dkza0cxz5) · Ubuntu · 0 upvotes · 0 comments --- Tags: [#java](https://daily.dev/tags/java), [#cryptography](https://daily.dev/tags/cryptography) [View this post on daily.dev](https://daily.dev/posts/announcing-oracle-jipher-10-37-fips-140-3-cryptography-for-java-bihfps62i) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Announcing Oracle Jipher 10.37: FIPS 140-3 Cryptography for Java","url":"https://daily.dev/posts/announcing-oracle-jipher-10-37-fips-140-3-cryptography-for-java-bihfps62i","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/announcing-oracle-jipher-10-37-fips-140-3-cryptography-for-java-bihfps62i"},"datePublished":"2026-08-25T06:14:16.799Z","dateModified":"2026-08-25T06:14:41.479Z","description":"Oracle Jipher 10.37 updates the packaged OpenSSL FIPS module to 3.5.7, fixing CVE-2026-42770 and correcting an AES-KWP unwrap output buffer size issue. The...","image":"https://media.daily.dev/image/upload/s--CxzD6vbw--/f_auto/v1722860399/public/Placeholder%2005","thumbnailUrl":"https://media.daily.dev/image/upload/s--CxzD6vbw--/f_auto/v1722860399/public/Placeholder%2005","isAccessibleForFree":true,"articleSection":"Inside Java","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Inside Java","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/de5992d95f374790bdfd2ae03a16f6e3","url":"https://daily.dev/sources/inside_java"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/announcing-oracle-jipher-10-37-fips-140-3-cryptography-for-java-bihfps62i","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"java,cryptography","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Inside Java","item":"https://daily.dev/sources/inside_java"},{"@type":"ListItem","position":3,"name":"Announcing Oracle Jipher 10.37: FIPS 140-3 Cryptography for Java"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/announcing-oracle-jipher-10-37-fips-140-3-cryptography-for-java-bihfps62i#faq","mainEntity":[{"@type":"Question","name":"What changed in Oracle Jipher 10.37 and does it fix a CVE?","acceptedAnswer":{"@type":"Answer","text":"Oracle Jipher 10.37 updates the patched OpenSSL FIPS module to version 3.5.7, incorporating the fix for CVE-2026-42770, and corrects the size of the output buffer used to receive AES-KWP unwrap output. It supports Oracle JDK 17 and 21 plus GraalVM for JDK 17 and 21 on Oracle Linux and Red Hat Linux 8, 9, and 10. Track cryptography CVE fixes like this one for Java FIPS deployments on daily.dev."}},{"@type":"Question","name":"Does Oracle Jipher still support DSA and Triple DES key generation after the FIPS 140-3 update?","acceptedAnswer":{"@type":"Answer","text":"No, as of the Jipher 10.36 FIPS 140-3 compliance update, DSA key and signature generation and Triple DES key generation and encryption are no longer supported. Existing DSA keys can still be imported with signature verification available under default enforcement policy, and existing Triple DES keys can still be decrypted under default policy, but new key generation for both is removed. Developers migrating FIPS-regulated Java apps can follow algorithm restriction changes like these on daily.dev."}},{"@type":"Question","name":"Is GraalVM still supported for FIPS-certified Java workloads with Oracle Jipher?","acceptedAnswer":{"@type":"Answer","text":"Jipher 10.37 is the last planned update release supporting GraalVM for JDK 17 and GraalVM for JDK 21. Oracle Java SE customers running FIPS-certification workloads on GraalVM are advised to transition to Oracle JDK instead, with Oracle Support available for migration assistance. Teams planning a GraalVM to Oracle JDK migration for FIPS compliance can follow updates like this on daily.dev."}}]} ```