You are not choosing between Corretto and OpenJDK
Every credible Java runtime, Corretto included, is built from the OpenJDK source tree. The upstream reference builds are not a competing distribution, they are the same code without a patch stream. Framing it as a product comparison hides the only variable that matters in production.
Prepared by Redress Compliance · August 11, 2026 · Java advisory. Based on 40 to 60 Oracle Java assessments and migrations, 2024 and 2025.
Executive summary
Corretto holds an LTS release for eight years, while upstream reference builds stop receiving updates when the next version ships six months later. That is the entire decision on a production estate.
Both are free, both are TCK certified, and both are built from the same source, so cost and compatibility do not separate them. Patch longevity does, and on a Java 17 or 21 estate the difference is not a feature gap, it is the whole patch stream.
Estates that stayed on unsupported upstream builds accumulated unpatched CVE exposure within two quarters of a version going end of life. Two quarters is fast enough that this is not a planning problem for next year, it is a live one.
The exposure is silent because nothing breaks when a build stops receiving patches, which is precisely why estates drift into it without a decision ever being taken.
Migrations off Oracle Java SE subscriptions completed in 3 to 9 months for most estates, with under 5 percent of applications needing remediation.
The technical risk in leaving Oracle is far smaller than the licensing exposure of staying, and the sub 5 percent remediation figure is the number to put in front of anyone arguing the migration is dangerous. Runtime cost fell to zero with no measured stability regression.
AWS centric estates defaulted to Corretto and mixed estates to Temurin, with the choice driven by operational tooling rather than technical capability.
Both are free, certified, and long supported, so the tie is broken by which one your build pipeline, base images, and support relationships already fit. Treating this as a technical evaluation spends weeks on a question the operating model has already answered.
Corretto against upstream OpenJDK builds
| Dimension | Amazon Corretto | Upstream OpenJDK builds |
|---|---|---|
| Cost | Free | Free |
| LTS patch stream | 8 years per LTS release | None once the next release ships |
| Patch cadence | Quarterly, aligned to the CPU calendar | Current version only |
| Certification | TCK certified | TCK certified |
| Support channel | AWS Support and community | Community only |
| Production fit | Strong, validated at AWS scale | Development use |
Read down the table and notice how little separates them until the second row. Cost is identical, certification is identical, and the source is literally the same tree, which is why teams comparing feature lists conclude the choice barely matters.
On an application that tracks the latest Java version and rebuilds constantly, that conclusion is correct. On a production estate sitting on Java 17 or 21 for years, the second row is the only row: one option receives quarterly security patches for eight years and the other stops in six months.
The practical rule is that production workloads run distributions and upstream reference builds are for developing against the latest version. The alternatives are compared in the OpenJDK options guide.
Picking the landing zone
- Rule out upstream reference builds for production first, because they carry no LTS patch stream and estates on them accumulated unpatched CVE exposure within two quarters of end of life.
- Let the operating model break the tie between Corretto and Temurin, since AWS centric estates defaulted to Corretto and mixed estates to Temurin on tooling fit rather than technical capability.
- Check whether you need a contractual support relationship, because Corretto support runs through AWS Support and the community, with no standalone Corretto contract for non AWS customers.
- Confirm the patch cadence matches your change calendar, as Corretto tracks the quarterly Critical Patch Update dates that most enterprises already plan maintenance around.
- Size the remediation work honestly, since under 5 percent of applications needed changes across 40 to 60 migrations, which is usually far below what the internal debate assumes.
The Java audit defence kit
The Oracle Java exit framework, the usage evidence list, and the audit posture for estates leaving the subscription.
Get the kit →The comparison is a category error, and it costs money
The framing of this question does real damage, so it is worth correcting before anything else. OpenJDK is not a product competing with Corretto. It is the open source project where Java is developed, and Corretto, Temurin, Zulu, and Liberica are all built from that same source tree.
What the project publishes is a set of reference builds, and those builds stop receiving updates the moment the next version ships.
So a team that believes it is choosing between two distributions is really choosing between a distribution and the absence of one, and because both are free and both are TCK certified, nothing in a feature comparison reveals that.
This is how estates drift onto unsupported builds without anyone taking a decision: nothing breaks when the patch stream ends, the runtime keeps working perfectly, and the exposure shows up only as unpatched CVEs accumulating within two quarters.
The second consequence of the category error is more expensive. Because the choice among distributions looks like a significant technical evaluation, it absorbs attention that belongs on the Oracle exit, which is where the actual money is.
Our migration data says the landing zone is close to the least consequential part of that project: runtime cost went to zero on either Corretto or Temurin with no measured stability regression, migrations completed in three to nine months, and under 5 percent of applications needed remediation.
The choice between the two credible options was settled by operational tooling, not capability, which means it should be a short conversation with whoever owns the build pipeline and base images rather than a formal evaluation.
Spend the saved effort on the exit itself, and on the one genuine limitation worth checking: Corretto support runs through AWS Support and the community, with no standalone contract for non AWS customers.
So estates that need a contractual support relationship independent of cloud spend should look at Azul or BellSoft instead.
The subscription mechanics you are leaving are set out in the employee metric analysis.
- Percentile standing for your exact deal size and industry, from real closed transactions
- Scenario simulation before the call: test alternative terms and see the financial impact of each
- A negotiation playbook, talking points, and a two page executive brief on day one
What we saw across Java estate migrations, 2024 and 2025
Across roughly 40 to 60 Oracle Java assessments and migrations advised on between 2024 and 2025, estates landing on Corretto or Temurin cut Java runtime cost to zero with no measured stability regression:
The share of the estate that required any change during migration, well below what the internal risk debate usually assumes.
How quickly estates that stayed on upstream reference builds accumulated unpatched vulnerabilities after a version reached end of life.
Three patterns recurred: migrations off Oracle Java SE completing in 3 to 9 months with under 5 percent of applications needing remediation, AWS centric estates defaulting to Corretto and mixed estates to Temurin on tooling fit rather than capability.
And estates that stayed on unsupported upstream builds accumulating unpatched CVE exposure within two quarters.
The wider library sits in the Java practice.
Your first five moves
- Inventory which builds are actually running in production, because upstream reference builds carry no patch stream and estates drift onto them without a decision ever being recorded.
- Rule out unsupported builds before comparing distributions, since the real gap is between having a patch stream and not having one, not between Corretto and Temurin.
- Settle Corretto against Temurin on tooling fit in one conversation, as both are free, certified, and long supported, and the operating model has usually already answered it.
- Check whether you need a support contract independent of cloud spend, because Corretto has no standalone support agreement for non AWS customers and Azul or BellSoft cover that case.
- Put the effort into the Oracle exit, not the landing zone, where migrations ran 3 to 9 months at under 5 percent remediation. The Java practice runs the exit with you.
Frequently asked questions
Is Corretto a fork of OpenJDK?
No. Corretto is a distribution built from the OpenJDK source tree, as are Temurin, Zulu, and Liberica. OpenJDK is the project where Java is developed rather than a competing product, which is why comparing Corretto to OpenJDK compares a distribution against the absence of one.
What actually separates Corretto from upstream reference builds?
The patch stream. Both are free and both are TCK certified, and the source is the same. Corretto holds an LTS release for eight years with quarterly updates, while upstream reference builds stop receiving updates when the next version ships roughly six months later.
How quickly does an unsupported build become a risk?
Estates that stayed on upstream builds accumulated unpatched CVE exposure within two quarters of a version going end of life. The exposure is silent because nothing breaks when patching stops, so the runtime keeps working normally while the vulnerability backlog grows.
Corretto or Temurin?
AWS centric estates defaulted to Corretto and mixed estates to Temurin, and the choice was driven by operational tooling rather than technical capability. Both are free, certified, and long supported, so it should be a short conversation with whoever owns the build pipeline and base images.
Does Corretto come with support?
Support runs through AWS Support and the community. There is no standalone Corretto support contract for non AWS customers, so estates that want a contractual Java support relationship independent of their cloud spend generally look at Azul or BellSoft instead.
How risky is migrating off Oracle Java?
Less than most internal debates assume. Across 40 to 60 assessments and migrations, most estates completed in 3 to 9 months with under 5 percent of applications needing remediation, and runtime cost fell to zero with no measured stability regression.
Does the patch cadence fit an enterprise change calendar?
Yes. Corretto tracks the quarterly Critical Patch Update dates that enterprises already plan maintenance windows around, so the Java patch stream lands on a rhythm the estate is generally already running rather than requiring a separate cycle.
