A Java LTS (Long-Term Support) release is a version of the JDK that receives security patches and bug fixes for years rather than the six months a normal feature release gets, and choosing one is the single most important step in keeping a Java service patchable. The current LTS lineup is Java 8, 11, 17, 21, and 25. If your production runtime is anything else, you are on a release that stopped getting fixes a long time ago.
Since JDK 9, Oracle and the OpenJDK project ship a new feature release every six months. Most of those are short-lived: the moment the next one arrives, public updates for the old one stop. LTS releases break that pattern. They are the versions vendors commit to patching for the long haul, which is why almost every serious deployment tracks an LTS line.
Which Java versions are LTS
The designated LTS releases are:
- Java 8 (March 2014) — the version that refuses to die
- Java 11 (September 2018) — the first LTS after the modular JDK 9
- Java 17 (September 2021)
- Java 21 (September 2023)
- Java 25 (September 16, 2025)
Java 17 was the point where the cadence tightened. From Java 8 through 17 the LTS gap was three years; starting with Java 21 it moved to a new LTS every two years. That means the next planned LTS is Java 29 in September 2027.
Everything in between — Java 9, 10, 12 through 16, 18 through 20, 22 through 24 — is a feature release. Useful for trying new language features, but not something you leave running in production, because updates dry up in six months.
Why LTS is a security control, not a preference
When public updates stop for a release, new CVEs against the JDK simply do not get patched on that line. You are then choosing between an unpatched runtime or an emergency migration under pressure. The whole point of tracking an LTS is to make patching routine instead of a fire drill.
Java 8 is the classic cautionary tale. Free public updates from Oracle ended in January 2019. Plenty of shops kept running Oracle JDK 8 anyway, unaware that they had drifted onto a build with no security backports and, in Oracle's case, potential licensing exposure. Oracle now offers commercial updates for Java 8 through December 2030, but that is a paid arrangement, not the free public stream people assumed they were on.
The lesson: know not just your major version but your update level and where the free support window actually ends.
Support windows and the overlap period
Oracle structures support in tiers. Premier Support delivers bug and security fixes for at least five years from a version's general availability. Extended Support, available only for LTS releases, adds roughly three more years of fixes. After that comes Sustaining Support, which is indefinite but ships no new security fixes — effectively a museum.
There is also an overlap window each time a new LTS lands. When Java 25 shipped in September 2025, it started a one-year overlap for teams still on Java 21. Free-license updates for Java 21 released after September 2026 move to the Oracle No-Fee Terms and Conditions (NFTC) / OTN license terms, so teams wanting to stay on a permissively licensed build are expected to move to Java 25 or later by then.
If licensing terms make your eyes glaze over, that is exactly why they cause incidents — the runtime keeps working, so nobody notices the support window closed until an auditor or a CVE forces the question.
Picking an LTS for a new project
For a greenfield service in 2025 or 2026, Java 21 or Java 25 are the sensible targets. Both are current LTS releases with years of patches ahead of them, and both include years of language and runtime improvements over Java 17 — virtual threads (finalized in 21), pattern matching, and record patterns among them.
Java 17 is still fine if you have a large existing codebase on it, but it is now the oldest LTS most teams should still be starting from, and its free-update runway is shorter than 21 or 25. Java 11 and Java 8 should be treated as migration targets away from, not toward.
A quick way to check what you are actually running:
java -version
# openjdk version "21.0.4" 2024-07-16 LTS
The LTS suffix in the version string tells you the line is a long-term support build. If it is absent, you are on a feature release and should plan an upgrade before its six-month window closes.
Keeping an LTS runtime actually patched
Being on an LTS is necessary but not sufficient. Within an LTS line, minor updates (21.0.1, 21.0.2, and so on) ship quarterly with the security fixes. Running Java 21.0.0 for two years is nearly as exposed as running an EOL version.
Track the update level in your base images and CI, not just the major version. A dependency and container scanner — the kind of thing an SCA tool such as Safeguard surfaces — can flag when your JDK base image has fallen behind on quarterly patches, the same way it flags an outdated library. If you want the broader dependency picture, see how software composition analysis tracks the rest of your stack, and the Academy has a walkthrough on wiring version checks into a pipeline.
FAQ
Is Java 21 or Java 25 the better LTS to target?
Both are current LTS releases. Java 25 (September 2025) is the newest and has the longest free-update runway, so it is the strongest default for new projects. Java 21 remains a solid choice, especially if you are already on it, but its permissive-license update window narrows after September 2026.
Is running Java 8 a security risk?
Running Java 8 without a paid support contract is risky because free public updates ended in January 2019, meaning no free security backports. Oracle sells commercial updates through December 2030, but the free public stream stopped years ago. Plan a migration to a current LTS.
How often do LTS releases get security patches?
LTS lines receive quarterly updates (the .1, .2, .3 minor releases) carrying the latest security fixes. Being on an LTS is not enough on its own; you also have to keep applying those quarterly patches.
When is the next Java LTS after 25?
Oracle plans a new LTS every two years, so the next planned LTS is Java 29 in September 2027. The feature releases in between (26, 27, 28) get only six months of updates each.