Build1 publisher3 min readPublished
A Jackson Databind CVE fix ships in the Payara release that removes @Traced
JDK 27 went GA the same week Azul Payara 7.4.0 patched an unauthenticated CPU-exhaustion bug in Jackson Databind and dropped MicroProfile OpenTracing, so the security upgrade now carries an instrumentation edit with it.
The Engineer · Build desk
What happened
- Azul Payara 7.4.0 resolves CVE-2026-68497, a Jackson Databind flaw where one unauthenticated request of a few megabytes forces up to several minutes of single-threaded CPU work.
- The same Payara release removes support for MicroProfile OpenTracing, so the @Traced annotation can no longer be used.
- Ivar Grimstad of the Eclipse Foundation put the Jakarta EE 12 Core Profile in December, with the Web Profile and Platform specifications planned for Q1 and Q2 next year.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- decision Payara operators choose between deploying the CVE fix now and doing the tracing rework in the same window, or holding the security patch until the instrumentation is ported.
- cost The port scales with the number of annotated classes plus whatever consumed the spans, and it falls on the team that wanted a Jackson Databind patch.
- constraint A JDK 27 upgrade cannot be sized off this record: a count of nine JEPs is enough to schedule a slot, and no help in estimating the work inside it.
- precedent A team that wants JDK 27 and a Platform-level Jakarta EE 12 in one move is planning for Q2 2027 at the earliest.
The Jackson Databind vulnerability that Azul Payara 7.4.0 closes is reachable without authentication. An attacker submits a single large request, a few megabytes, and forces up to several minutes of single-threaded CPU work; the release notes say that can saturate a server's worker threads [7]. Thread count is the limit that binds first. The fix lands in Community Edition 7.2026.9, Enterprise Edition 6.42.0 and Enterprise Edition 5.91.0 together [6].
In the same release, support for MicroProfile OpenTracing is removed and the `@Traced` annotation can no longer be used [9]. That specification moved out to MicroProfile's standalone set at 6.0, so the removal has been visible for a while [10]. The practical effect is that the change window carrying a CPU-exhaustion fix also carries an edit to every class annotated `@Traced`, and to whatever reads those spans. MicroProfile 7.1 support arrives in all three editions [8], and Payara Micro and Payara Embedded pick up the Jakarta Agentic AI specification [11].
BellSoft's Liberica JDK 27 shipped as a downstream OpenJDK distribution the same week [2]. Its changelog is 2,542 fixes, 2,387 in OpenJDK and 155 in JavaFX, and BellSoft contributed three of them [3][4]. The engineering came from upstream; the downstream share of the changelog is 0.12 percent [5].
On JDK 27 itself the record here is a count. Oracle shipped version 27 of the language and virtual machine with a final feature set of nine JEPs [1], and the roundup refers readers to a separate InfoQ story instead of listing them [17]. Nine JEPs can mean a recompile or a quarter of migration work, and the list is what separates the two. Build 16 of the JDK 28 early-access builds went out in the same week, with fixes carried over from Build 15 [15].
Ivar Grimstad, Jakarta EE Developer Advocate at the Eclipse Foundation, wrote in his weekly Hashtag Jakarta EE blog: "Jakarta EE 12 Core Profile will be released in December this year. The Web Profile and Platform specifications are planned to be released in Q1 and Q2 next year, so the Jakarta EE Platform project now also focuses on gathering feedback from the participating specifications." [12][13] Read from that September 2026 post, the Core Profile is December 2026 and the Platform specification is Q2 2027 [19].
Open J Proxy 1.0.0 went GA with a local cache on the immutable `DatabaseMetaData` and `ResultSetMetaData` classes, an implementation of the Core JDBC Type 3 driver, and a new `ojp.connection.pool.leakDetectionThreshold` property that sets a leak detection threshold on the HikariCP pool [14]. WildFly's A2A Java SDK for Jakarta Servers 1.0.0.Final threw out its duplicated multiversion routing and now annotates classes and interfaces in `a2a-jakarta-http-common` with `@PreMatching`, discovering `A2AVersionProvider` instances through CDI [16].
What to watch
- Whether Payara documents a replacement path for the spans that @Traced used to emit, in a later 7.4.x note.
- Publication of the JDK 27 JEP list in detail; the list decides whether the upgrade is a recompile or a migration project.
- The Jakarta EE vote on including Jakarta NoSQL 1.1 in EE 12, where only committers' votes are binding.