Direct answer

Oracle’s October 20, 2026 Critical Patch Update included Java 25.0.5. PaperMC’s current Java requirements recommend Java 25 for Paper 26.1 and newer. If your server uses Java 25, check which JDK vendor and patch release your actual server process runs, then apply the equivalent security updates from your vendor after testing. Oracle version numbers are not a guarantee that all vendors use identical build numbers.

Identify the real runtime

java -version

Run this command inside the same container, startup environment or hosting panel that launches the Minecraft server. The host OS and game container can have different Java installations. Capture the JDK vendor, major version and patch level.

Patch with a rollback path

  1. Check the required Java major version for your exact server software, loader and plugins. Older Minecraft or modded setups may still require Java 21 or 17.
  2. Schedule maintenance and preserve the current JDK image/tag or installer, startup script, server JAR and full backup.
  3. Install the current supported security-patched Java 25 build from your chosen vendor, or switch the panel’s game-image/runtime selection.
  4. Restart a staging instance and check java -version, server logs, plugins/mods, scheduled tasks and player joins.
  5. Roll out production during a maintenance window and monitor startup and memory behavior. Keep a tested compatible rollback image.

What a Java CPU does not prove

Oracle’s security bulletin covers Java products and configurations. It does not mean a specific Minecraft server is remotely exploitable. Avoid broad claims about a CVE without confirming the runtime, attack prerequisites and vendor guidance.

Common mistakes

  • Updating system Java without changing the Docker image that runs Minecraft.
  • Changing the major Java version just because a newer release exists.
  • Testing only java -version from your own desktop rather than the server process.

Official references

Official sources for version-sensitive details. Check the newest release notes before changing a production server.

Was this article helpful?
Help us improve this article

Tell us what is missing, unclear, outdated, or incorrect. You can also suggest something we should add.

What could we improve?
Do not include passwords, server IPs, or other private information.0 / 1000