Azul patches Java after eMudhra certificate compromise

Azul has released security updates for its Java distributions after eight eMudhra intermediate Certificate Authority certificates were compromised. The updates were issued within 24 hours of the public disclosure.

The release covers multiple versions of Azul Zulu and Azul Prime and blocks all eight compromised certificates without requiring users to manually change Java installations.

The issue centres on intermediate certificate authority keys disclosed as compromised after being generated defectively, according to eMudhra and confirmations cited from Mozilla and Google's Chrome Root Program. The flaw meant attackers could potentially derive private keys from public certificates and impersonate websites and services that trusted the affected certificate chain.

Browser and operating system vendors, including Apple, Google, Microsoft and Mozilla, have already blocked the certificates. Java environments pose a separate problem because Java runtimes do not automatically receive revocation data and do not check certificate revocation by default.

That means unpatched Java Development Kits could still accept forged certificates signed with the compromised keys if they trust the relevant root certificates. For organisations running large Java estates, the practical options are to update the JDK itself or manually place a blocked certificate file into every runtime, including versions embedded in applications, container images and continuous integration pipelines, and then restart them.

Azul chose to deliver the block through standard software updates rather than rely solely on manual intervention. It also published a workaround for systems that cannot be updated immediately.

The new releases apply to Azul Zulu Builds of OpenJDK for Java 27, 25, 21, 17, 11, 8, 7 and 6, and to Azul Prime for Java 25, 21, 17, 11 and 8. The updated builds add the compromised certificates to the JDK's blocked certificate list.

Why Java matters

The incident underlines a long-standing challenge for companies that depend on Java for business software and infrastructure. Browsers and operating systems tend to handle certificate distrust through built-in revocation and root programme updates. Java environments, by contrast, often depend on direct action from runtime vendors and enterprise operations teams.

As a result, a certificate compromise can create a gap between browser makers' actions and those taken inside server-side systems. In many organisations, Java runtimes span production servers, internal services, cloud instances, and software supply chains, complicating rapid response.

Azul framed the latest release as part of a security-only update model designed to reduce the risk that an urgent patch introduces unrelated software changes. This approach uses a prior-cycle release with only security fixes added.

Operational pressure

The broader concern for enterprise users is not limited to the eMudhra incident. Security teams often have to choose between patching quickly and avoiding disruption to live systems, especially where Java runtimes are embedded in older applications or distributed across container images and development pipelines.

Azul advised enterprises to identify software that still trusts the compromised certificates, apply vendor updates that block them and use manual workarounds only as a temporary measure where updates are unavailable. A full installable update is generally preferable, it said, because it fits existing deployment processes and avoids editing each JDK installation by hand.

The company noted, citing eMudhra's account, that only one of the eight compromised intermediates was ever used in production and that none issued end-entity certificates. It also referenced Google's report that no certificates chaining to those intermediates were found in Certificate Transparency logs.

Even so, every software component that makes trust decisions must respond when certificate authority keys are compromised. In Java's case, that means updating the runtime or manually distributing a block list to each affected installation.

The episode comes as software suppliers face pressure to shorten response times for disclosed security issues. Azul said fast delivery matters because attackers can move quickly once flaws become public. Its out-of-cycle update was released the day after Mozilla and Google's Chrome Root Program publicly confirmed the compromise of the eMudhra intermediate certificates.