# Jdk upgrade for ES v7.x

**URL:** <https://discuss.elastic.co/t/jdk-upgrade-for-es-v7-x/268524>\
**Category:** Elasticsearch\
**Created:** [March 26, 2021, 5:28pm UTC](https://discuss.elastic.co/t/jdk-upgrade-for-es-v7-x/268524 "2021-03-26T17:28:33Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![sb116](https://avatars.discourse-cdn.com/v4/letter/s/ac8455/32.png) [@sb116](https://discuss.elastic.co/u/sb116)\
**Post date:** [March 26, 2021, 5:28pm UTC](https://discuss.elastic.co/t/jdk-upgrade-for-es-v7-x/268524/1 "2021-03-26T17:28:33Z")

</div>

is there a way to upgrade embedded jdk from 15.x to 15.0.2/3 for ES v7.x?

---

<div class="post-metadata">

**Author:** ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)\
**Post date:** [March 28, 2021, 6:35pm UTC](https://discuss.elastic.co/t/jdk-upgrade-for-es-v7-x/268524/2 "2021-03-28T18:35:11Z")

</div>

Yes, according to [the reference manual](https://www.elastic.co/guide/en/elasticsearch/reference/current/setup.html#jvm-version). Out of interest, why do you want to do that? The bundled one is recommended, and is the one that gets the most thorough testing.

---

<div class="post-metadata">

**Author:** ![sb116](https://avatars.discourse-cdn.com/v4/letter/s/ac8455/32.png) [@sb116](https://discuss.elastic.co/u/sb116)\
**Post date:** [March 29, 2021, 12:44am UTC](https://discuss.elastic.co/t/jdk-upgrade-for-es-v7-x/268524/3 "2021-03-29T00:44:43Z")

</div>

We found security issues per Oracle Java vulnerability doc and recommended version is 15.0.2.

I did not see steps to install embedded jdk version to 15.0.2 and above.

---

<div class="post-metadata">

**Author:** ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)\
**Post date:** [March 29, 2021, 6:49am UTC](https://discuss.elastic.co/t/jdk-upgrade-for-es-v7-x/268524/4 "2021-03-29T06:49:45Z")

</div>

I can't comment on the specific JDK vulnerabilities you are asking about, but as a general point Elasticsearch is often not subject to vulnerabilities in its dependencies, including the bundled JDK, because the vulnerability only applies when using features that Elasticsearch itself does not use. Are you sure that you really need to take mitigating action?

If you suspect that Elasticsearch (including the bundled JDK) is genuinely vulnerable then you should report this to [security@elastic.co](mailto:security@elastic.co). If the vulnerability is confirmed then a new version, with upgraded JDK, will be released ASAP.

> [@sb116](#):
>
> I did not see steps to install embedded jdk version to 15.0.2 and above.

Did you click the link in my previous post? There are no steps spelled out, you just configure Elasticsearch to use the JDK you want.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 26, 2021, 6:50am UTC](https://discuss.elastic.co/t/jdk-upgrade-for-es-v7-x/268524/5 "2021-04-26T06:50:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.