Introduction
Renewing your Oracle Java SE license might feel like routine business—but for universities, it’s become an expensive trap. In 2023, Oracle introduced the Java Employee License Metric (JELM), which counts not only faculty and staff, but also adjuncts, contractors, and sometimes even students who never touch a Java app. The result? Licensing costs that can skyrocket 2–5x overnight.
Oracle Java SE is built on OpenJDK, an open-source platform that’s freely available and supported by multiple vendors. In other words, you’re not locked into Oracle to get stable, secure, fully compatible Java builds—or the expert support your campus systems rely on.
A recent ITAM survey (The ITAM/SAM Survey & Report, 2025) found 73% of enterprises that use Java have been audited for their Java use by Oracle in the past three years. The threat of a Java audit by Oracle is very real. Even a single system running a paid Java runtime can make the entire university liable to pay Oracle’s new JELM licensing fees.
The good news is, you can keep everything running exactly as before — same Java, same quarterly and out-of-cycle updates, same performance — without the runaway costs. Moving to an OpenJDK distribution from a trusted third-party provider gives you stable, secure builds, and long-term support — even for older technology like Java 6 and 7 — with licensing terms that make sense for higher ed budgets.
Key Factors When Choosing an OpenJDK Provider
- Breadth of commercial support: Ensure your JDK provider supports all the JVMs used by your organization.
- Drop-in replacement for Oracle Java SE: Choose a 1-to-1 replacement for Oracle JDK to avoid modifying source code or recompiling application code.
- Timely release of security patches: Verify that your provider offers timely releases of out-of-cycle security patches.
- CPUs (Critical Patch Updates): Verify your provider offers security-only updates (not just Patch Set Updates) that can be quickly deployed to meet security compliance requirements.
- Duration of support terms: Check the duration of standard and extended support in your Java distributions.
- Pricing model: Consider usage-based pricing over employee-based pricing.
Many Versions of Java
Many people are confused by references to the different versions of Java, such as Java 8, 11, 17, and so on, as well as terms like Oracle Java SE, OpenJDK, and Oracle JDK.
The key thing to understand is that Java runs on a JVM. The Java Development Kit (JDK), which includes the JVM, is updated every three months with new builds of OpenJDK, the reference implementation for the Java SE standard. Oracle offers Java SE to customers in a subscription that includes both licensing and support.
When we mention the different versions of Java (such as Java 8, 11, and so on), we’re referring to new builds of the Java platform that support Java applications. In other words, we’re referring to new builds of the OpenJDK reference implementation, which Oracle implements in the Oracle JDK.
You can download unsupported builds of OpenJDK for free under an open-source license at jdk.java.net. Commercially supported builds of OpenJDK are also available from several vendors that have typically licensed Oracle’s Technology Compatibility Kit (TCK) to ensure functional equivalence. As a result, OpenJDK vendors can provide drop-in equivalents to Oracle builds, often at a much better value. While Oracle JDK is licensed under the Oracle Technology Network License Agreement and Oracle No Fee Terms and Conditions, OpenJDK can be used under the GNU General Public License version 2, with a linking classpath exception. Oracle JDK and OpenJDK are technically equivalent.
Breadth of Commercial Support
Java’s Many Flavors
“What is Java?” It’s a question members of the Java community hear constantly. “It’s one of the world’s most popular programming languages,” is the stock answer. But it is only half true. There isn’t just one version of Java. Currently, there are 24 versions, with a new version released every six months.
The pace of innovation has helped Java rank #3 in the TIOBE Index for February 2025. Java also ranks in the top five of the fastest and most energy efficient languages (Alibaba Cloud, 10 Programming Languages That Are Energy Efficient, June 7, 2022)
| Rank | Language |
|---|---|
| 1 | C |
| 2 | Rust |
| 3 | C++ |
| 4 | Ada |
| 5 | Java |
| 6 | Pascal |
| 7 | Chapel |
| 8 | Lisp |
| 9 | Ocaml |
| 10 | Fortran |
Continuous innovation comes with its challenges. Your university likely maintains applications built on various Java versions, including older ones like Java 6 and 7, which are no longer commercially supported by most vendors. However, Azul still supports both Java 6 & 7.
1,000 JDKs
Sun released Java, the first “write once, run anywhere” software language, in May 1995. The company changed software development forever. Java decoupled applications and the underlying hardware they ran on, which offered a huge advantage for application developers. But the software engineers assigned to maintain the underlying Java infrastructure had just as much work as before.
Today there are as many Java Virtual Machines (JVMs) as there are different devices running Java. Commercial providers can maintain more than 1,500 JVMs to cover different Java versions, operating systems (such as Windows, Windows Server, macOS, Linux (RHEL, SLES, CentOS, Ubuntu, Debian, and Alpine Linux), QNX, and Solaris), 32-bit and 64-bit systems, and various hardware configurations. The sheer volume of JVMs led to the development of package managers that handle different JVM versions and dependencies. However, the sprawling technology landscape makes it hard to ensure consistency and compatibility across many different Java development environments.
These JVM versions are updated on a quarterly basis, when reference implementations are released, which contain security patches, bug fixes, and enhancements. Continuous updates mean continuous debugging.
Guidance: Make sure your JDK provider supports all the JVMs used by your organization, including older JVMs and the range of deployment platforms they run on.
A Drop-In Replacement for Oracle Java SE
120,000+ Compatibility Tests
Many OpenJDK providers say their JVMs are drop-in replacements for the Oracle JDK. But what does that mean and how can you verify their claim? The answer is simple: they need to be certified Java SE compliant using TCK tests.
What is a TCK test? For 25 years, the Java Community Process has overseen each version of Java via a Java Specification Request. The Java Technology Compatibility Kit (TCK) is a suite of tests and tools licensed by Oracle so OpenJDK vendors can certify whether a Java technology implementation meets the required specification.
To be a drop-in replacement for Oracle JDK, your OpenJDK provider must pass more than 120,000 tests. These two steps ensure that you can easily swap out the Oracle JDK: first, install it in the directory of your choice, and then configure your application. For example, you can modify the JAVA_HOME environment variable to point to the directory where OpenJDK is installed.
With a drop-in replacement, you don’t have to modify source code or recompile your application. The steps are similar to installing an update for the Oracle JDK.
Guidance: Only consider OpenJDK builds that are TCK-tested.
Timely Release of Security Patches
Fixing Vulnerabilities
The National Institute of Standards and Technology (NIST), in the U.S. Department of Commerce, defines a software vulnerability as a security flaw or weakness found in software code that attackers can exploit. Since 1999, known vulnerabilities have been assigned IDs. The MITRE Corporation, an independent, not-for-profit company, tracks these issues in the Common Vulnerabilities and Exposures (CVE) List, which is one of the world’s most widely referenced security databases.
Vulnerabilities on the CVE List are scored from 0 to 10, using the Common Vulnerability Scoring System from the National Vulnerability Database. A score of 0.0 means no severity, while 9.0-10.0 means critical severity. The log4Shell vulnerability, which affected the Java logging framework log4j, received a score of 10 because it allowed attackers to execute commands on a target device. Even low-scoring CVEs can put an organization at risk and should be patched as quickly as possible.
Fixes for OpenJDK vulnerabilities are added to the CVE List after they are reviewed by the OpenJDK Vulnerability Group. This group, which is made up of trusted members of the OpenJDK community, fixes reported issues and then releases the fixes four times a year. Oracle releases updates to Java SE first, and the alternative providers follow at a cadence that can range from under an hour to several days or weeks.
| CVE Score | Severity |
|---|---|
| 9.0 – 10.0 | Critical |
| 7.0 – 8.9 | High |
| 4.0 – 6.9 | Medium |
| 0.1 – 3.9 | Low |
| 0.0 | None |
In 2024, OpenJDK Vulnerability Advisory reported seven vulnerabilities with high severity, seven vulnerabilities with medium severity, and 18 vulnerabilities with low severity.
Guidance: To reduce your risk of data breaches or attacks, make sure you deploy quarterly security patches as soon as they’re released.
Offers Critical Patch Updates
Stable and Secure
Security patches to OpenJDK are typically delivered in two formats. The most common format is called a Patch Set Update (PSU). These quarterly updates contain the security fixes recommended by the OpenJDK vulnerability group, as well as bug fixes and feature enhancements. PSUs can contain anywhere from 100 to over 400 changes depending on the Java version.
Can PSUs cause regressions? It’s not unusual for a PSU to cause a regression. Some of these can be quite serious, resulting in application instability and business disruption for quite some time before a fix is released. In August 2022, for example, a new build was released for Java 8 to eliminate the possibility of a system crash that had been introduced with a July update (OpenJDK 8u342). Even more serious regressions have prevented access to critical infrastructure like Hadoop, Solr/Lucene.
For this reason, Oracle and Azul offer stabilized builds known as Critical Patch Updates (CPUs). Rather than include all the new quarterly bug fixes and enhancements, CPUs only provide new security fixes. These are based on builds released the previous quarter and have had three months to stabilize. To date, no CPU release from Azul has experienced a regression.
It can be just as important for customers to access out-of-cycle fixes for zero-day vulnerabilities. Waiting up to 90 days for a critical fix leaves universities open to exploitation by bad actors for far too long.
Guidance: Take the time to understand the difference between CPU and PSU builds of OpenJDK, as well as what it means to access out-of-cycle fixes to minimize your risk of business disruption.
Duration of Support Terms
Lengthening Support
Most companies choose the Java version with the longest support term. Once you build an application on a specific JVM, keeping it on that JVM as long as possible eliminates upgrade costs, which is why most applications are built on Long Term Support (LTS) versions of Java.
Azul’s 2025 State of Java Survey & Report surveyed over 2,000 Java professionals. Of the LTS versions of Java, 34% of the participants use Java 17, 31% use Java 21, 23% use Java 11, 23% use Java 8, 13% use Java 7, and 10% use Java 6. Also, 52% of the participants use more than one version of Java, which is down from 64% in 2023.
| Java version | Share of participants |
|---|---|
| 6 (LTS) | 10% |
| 7 (LTS) | 13% |
| 8 (LTS) | 23% |
| 9 | 9% |
| 10 | 11% |
| 11 (LTS) | 23% |
| 12 | 7% |
| 13 | 4% |
| 14 | 3% |
| 15 | 6% |
| 16 | 10% |
| 17 (LTS) | 34% |
| 18 | 13% |
| 19 | 11% |
| 20 | 10% |
| 21 (LTS) | 31% |
| 22 | 9% |
Java 8, first released in 2014 with free public updates, became an LTS release under Oracle’s new pricing model in 2019. While Premier Support for Java 7 ended in 2019, Oracle fully discontinued its commercial support in July 2022. Similarly, Oracle no longer supports Java 6. The shift to paid subscriptions took many organizations by surprise with unexpected costs.
Alternative Java vendors can offer very competitive support terms and lifecycles compared to Oracle. In some cases, the support offered for Java versions is longer than that of Oracle. For example, for LTS releases, Azul provides Production Support, which has at least eight years of access to bug fixes, security updates, and other fixes as needed, and they provide two years of additional Extended Support to advise and assist users to migrate to a newer JDK version. This includes support for versions of Java that Oracle no longer supports, like Java 6 and 7.
Guidance: Look for a vendor that offers not only competitive support terms, but the longest available support lifecycles for the versions of Java you use to minimize upgrade costs. Make sure you can negotiate even longer lifecycles if you need them.
Pricing Model
Usage-Based Pricing
Before Oracle’s January 2023 pricing change, the cost of running Java in higher education environments was primarily based on how many processors or vCores were needed to support applications. Universities could optimize costs by running Java workloads on fewer processors.
Under Oracle’s current Java SE model, pricing is no longer tied to actual usage. Instead, subscription costs are based on total institutional headcount — including faculty, staff, contractors, temporary employees, and in some cases even students—whether or not they ever use Java. For many universities, this shift has driven licensing costs up by 2x to 5x, creating unexpected financial strain and linking IT budgets to broader campus initiatives that have nothing to do with technology.
Fortunately, alternatives exist. Vendors like Azul continue to offer usage-based pricing models, charging by metrics such as vCores (for servers) or the number of desktops running Java.
What is a vCore? A vCore, short for virtual core or logical core, represents a unit of processing power—the same metric used by major cloud providers like AWS to price their virtual machines. By aligning Java licensing to actual usage, universities can keep costs predictable and control budgets more effectively.
Rising Needs and Rising Costs
Azul’s 2025 State of Java Survey & Report surveyed over 2,000 Java professionals. According to the survey, 85% of the participants pay for Java support, which is up from 66% in 2023.
Of the participants who don’t pay for Java support, 52% said they don’t need it, which is down from 62% in 2023. 31% said it’s not a priority, which is down from 33% in 2023. More organizations are recognizing their need for Java support each year.
Meanwhile, 21% of the participants who don’t pay say that support is too expensive, which is up from 18% in 2023. This shows that although more organizations recognize their need for Java support, more organizations recognize that it’s getting unaffordable.
Guidance: How you pay for Java can have a big impact on your TCO. Make sure you choose a pricing model that is aligned with your business needs.
Conclusion
For most Universities, Oracle Java SE’s pricing model quickly becomes cost prohibitive. Alternatives like Azul provide a seamless, drop-in replacement for Java SE at a fraction of the cost – typically 70% less than Oracle, while maintaining enterprise grade support and reliability. For a detailed side-by-side comparison, see the Oracle Renewal vs OpenJDK Comparison Guide.
The considerations outlined in this white paper can help your institution reduce the cost and complexity of managing Java environments. Whether you choose to stay with Oracle or move to an alternative provider, the key is choosing the option that delivers the greatest value for your students, faculty and IT organization.