The new updates are 1.8.0_331, (aka 8u331), 11.0.15, 17.0.3, and 18.0.1 respectively). And as is generally the case with these Java updates, most of them have the same changes and fixes.

For more on them, including changes as well as the security and bug fixes they each contain, see the Oracle resources I list below, as well as some additional info I offer for if you may be skipping to this from a JVM update from before Apr 2021. I also offer info for Adobe ColdFusion users on where to find the updated Java versions, what JVM versions Adobe CF supports, and more.

Finding more info on these Apr 2022 Java updates

First, see the technotes for each of 1.8.0_331, 11.0.15, and 17.0.3, and 18.0.1.

Second, see the Java security fixes in these Apr 2022 updates. (As of today, I am not finding a more elaborated discussion of Java security issues as I had found for the Jan 2022 update. Both those documents cover all Oracle products, but I have linked to the Java-specific sections of the pages.

Finally, see the listing of specific bug fixes in each update, as offered in a link at the bottom of those update technotes for each release above.

If you are not using Adobe ColdFusion, you can skip the next section.

News for my CF audience (getting the Java updates from Adobe or Oracle, why you should NOT for now use Java 17, etc)

Since the focus of my blog and work is indeed mostly focused on those using Adobe ColdFusion, I will clarify for them that:

• The Adobe downloads page for CF-related installers DOES now have the updated Java downloads in its bottom section. (It did not have them when I wrote this post, and indeed it has sometimes taken several days, causing confusion and heartburn, though more recently they've been there within a day or two of their release.)
• Do note that sometimes when the post the updates, they don't think to update the drop-down listing the java versions, to the latest version may not be at the top but in fact at the bottom. (I point that out whenever I see the mistake made, so hope they would soon correct it.)
• I have noticed that as of the Apr 2022 java updates, they have changed the location of the files. Using the Windows installer as an example (but it's true for all of the installers and zips), the location is now https://cfdownload.adobe.com/pub/adobe/coldfusion/java/java11/java11015/jdk-11.0.15_windows-x64_bin.exe, while the previous update was at https://download.macromedia.com/pub/coldfusion/java/java11/1114/jdk-11.0.14_windows-x64_bin.exe. It's good to see the update of things from old Macromedia links to Adobe, but this could trip up those using automation scripts.
• Of course, the Oracle site does of course always have the new downloads they day they come out. And while some assert that CF folks "must use those from the CF downloads page", I've confirmed in the past that the installers are binary the same (at least for the identical build number, which may change on the Oracle site though not the Adobe site), which includes the Java license, so I can't see how anyone could assert that it matters WHERE you get the same installer.
• If you use Pete Freitag's wonderful HackmyCF service, I can report that his service has now been updated to detect if you are not running the updated versions of either Java 8 or 11, in which case you can expect a notification warning.
• While Java 17 is indeed a new long-term support release for Java, so too are Java 8 and 11 still LTS releases. And ColdFusion 2021 and 2018 (the currently supported CF versions) do NOT yet support Java 17. They only support Java 11. (While CF2018 did support Java 12 for a time, that version lived only for 6 months, like all version between 11 and 17, so Adobe did not "keep up" with all those short-term versions.) We can expect a coming update to CF 2021 (and hopefully 2018) to add support for Java 17, as has been the pattern in the past. (CF2016 supported Java 8 or 11, depending on what CF update had been applied. More on CF2016 in a later bullet point here.)
• As for Java 18 and other short-term updates that follow it (like updates 12-16 had been), being an interim update I do not expect Adobe will be updating to support it (like they did not offer CF updates to support the interim updates before 17)
• If it may help you, see a past blog post I've done with a table of what CF versions formally support what Oracle Java versions.
• And in a post I did on the Apr 2019 jvm updates (which I point to in that "table" post), I cover such things as how CF only formally supports Oracle Java and not others, the short-lived Java 12 support, and more.
• As for how you would go about updating Java within CF, there are variations depending on how you installed CF (or Lucee), including whether you're using Commandbox or not (which can update it automatically if you like), or if using Lucee whether you're running it as a service or not, and so on. I have various resources I've created (blog posts, presentations) discussing especially updating CF and the JVM within CF, and these are covered at my cfupdate page. I can also offer direct remote consulting help.
• Finally, if you are on older, unsupported versions of CF (CF2016 or earlier) or Java (older updates to Java 11 or 8, or Java 7 or earlier), you are playing a dangerous game of Russian Roulette. You may not have been struck yet, but in Oct 2021 I offered a post about a nasty ransomware vulnerability hitting those who had failed to update CF with a fix Adobe had provided years ago! Even CF2016, last updated in March 2021, does not have security fixes in the updates for CF2018 and 2021 that Adobe released in Sept 2021, and any beyond. Don't be "that person", still running such older CF versions.

Should you apply the update? how soon?

This and the next section apply whether you may be using CF or not. Each org has to decide for themselves if the security fixes bug fixes, and any feature changes are of concern for them. Some folks/orgs tend to wait for some period of time to "let others be the guinea pigs", while others are concerned about security and so apply any new update with security fixes right away.

Of course, the best approach is to try things in a testing environment first, but many eschew that (for any of many reasons, at their peril). Even then, of course some problems don't show themselves in testing but only in production.

As noted in the security page above, even if you may not think you "need the changes in this update", do beware that you would be vulnerable to problems fixed in PREVIOUS updates. So it's always best to be on the latest update to the JVM version (like Java 8 or 11) you're using, as soon as possible.

Beware a change in the April 2021 JVM update, if you may be skipping over it

Finally, I want to point out that if you may be moving to this JVM update from an older one from before the JVM updates released in April 2021 (Java 11.0.11 and 1.8.0_291, respectively), do note that when you apply this update you will therefore inherit a rather important change that was introduced in those updates (and which remains, after them.)

Briefly, Java now no longer supports calling out (via https/tls) to servers that don't support at least TLS 1.2 or above. If you may be calling out to servers (via cfhttp or Java's httpclient, or via configuration of the CF Admin pointing to database servers, mail server, ldap servers, and the like), such requests will break upon applying those or later JVM updates, if those servers don't yet support at least TLS 1.2 or above.

Of course, you may not be responsible for and may have no control over those other servers you're calling out to, so you may prefer to tell Java to allow you to keep calling out to those for now. You can do that, via a simple one-line configuration change in a Java configuration file (not JVM args). More in a moment. That said, you are removing a protection that Oracle thinks is in your interest (modern browsers do also warn or even reject attempts to access servers via https if they don't support at least TLS 1.2 or above. This change is about how Java itself reacts to them.)

For more on this Java security change, and that configuration change needed to "undo it", see my post from April 2021 on those JVM updates released then.

Wrapping up, getting more help

Again, for direct help on any of these, I can offer remote screenshare consulting help, and am usually able to quickly fix problems that might take many folks hours to resolve them (if they don't deal with these issues daily like I do, helping people). Or of course, comments and questions are welcome below.

For more content like this from Charlie Arehart:

• Signup to get his blog posts by email:
• Follow his blog RSS feed
• View the rest of his blog posts
• View his blog posts on the Adobe CF portal

Need more help with problems?

• If you may prefer direct help, rather than digging around here/elsewhere or via comments, he can help via his online consulting services
• See that page for more on how he can help a) over the web, safely and securely, b) usually very quickly, c) teaching you along the way, and d) with satisfaction guaranteed