Azul shipped the first monthly Critical Security Patch Update (CSPU) in Java's history in August 2026, covering Java 26, 25, 21, 17, 11, 8 (Core/Zulu) and Java 25, 21, 17, 11, 8 (Prime/Zing). CSPUs are narrow security-and-stability-only releases published on the third Tuesday of months without a quarterly update, closing the gap where a critical fix could otherwise wait up to three months. Azul splits builds into CPU (security-only, recommended for production) and PSU (security plus accumulated non-security fixes, recommended for testing before rollout, and the only line available to free Zulu Community users). This release fixes five CVEs, four affecting Zulu builds, including one high and two medium severity issues touching 2D rendering, outbound HTTP, and TLS. Teams are advised to default to CPU builds in production and build automation to pick up releases as they land rather than on a fixed calendar date.
Table of contents
What is a CSPU?Two build lines: CPU and PSUAzul Zulu Build NumbersSecurity fixesWhat this changes for youWhere to get itQuestions this post answers
What is a CSPU in Azul's Java builds and how is it different from a quarterly CPU or PSU release?
A Critical Security Patch Update (CSPU) is a targeted release delivering only security and stability fixes between Azul's regular quarterly updates, published on the third Tuesday of months without a quarterly release. Unlike quarterly Critical Patch Updates (CPU) or Patch Set Updates (PSU), a CSPU adds no new features or API changes and undergoes the same build and stability testing as quarterly releases. daily.dev helps java teams track new patch cadences like Azul's CSPU without missing a critical update.
Should I deploy the CSPU CPU build or the CSPU PSU build to production for Java?
Azul recommends the CSPU for CPU build for production because it contains only critical and security fixes on top of the previous quarterly CPU, minimizing regression risk and letting teams reach production faster with less re-testing. The CSPU for PSU build carries accumulated non-security fixes too and is recommended for testing first; it's also the only line available to free Zulu Community (CA) users. java teams weighing CPU versus PSU builds can follow patching guidance like this on daily.dev.
What Java versions and CVEs did Azul's August 2026 Critical Security Patch Update fix?
The August 2026 CSPU covers Java 26, 25, 21, 17, 11, and 8 for Azul Core (Zulu) builds, with backports to Java 7 and 6, plus Java 25, 21, 17, 11, and 8 for Prime (Zing) builds via Azul Zing JVM 26.02.310.0. It fixes five CVEs, four of which apply to Zulu builds: one high-severity, two medium-severity, and one low-severity issue touching areas like 2D rendering, outbound HTTP, and TLS. security-conscious java developers can keep up with CVE patch releases like this through daily.dev.