Eclipse GlassFish is an application server, implementing Jakarta EE and MicroProfile. This release corresponds with the Jakarta EE 11 specification. Eclipse GlassFish 8 is production ready, commercially supported by OmniFish, and requires JDK 21 or higher.

Read about what's new in GlassFish 8.0.2 in this OmniFish blog article.

Release overview

This release contains a lot of important fixes in its own features and in updated dependencies.

Security Fixes

• Fixes CVE-2026-2586 9.1 CRITICAL - A critical Remote Code Execution (RCE) vulnerability in Admin Console
• Fixes CVE-2026-2587 9.6 CRITICAL - An authenticated Remote Code Execution (RCE) vulnerability in Admin Console
• Fixes CVE-2026-24457 9.8 CRITICAL - An unsafe parsing of OpenMQ's configuration, allows to read arbitrary files from a MQ Broker's server

New Features

• Support @EJB(beanName=...) for app clients by @arjantijms in #25962
• Improved behavior related to InetAddress, hostname resolution, added tests by @dmatej in #25972

Fixes

• Fixed ConfigProfileResolver service selection by @dmatej in #25964
• Fixes authentication with PAM login module by @avpinchuk in #25971
• Fix MP Config packaging by @OndroMih in #25981
• Fixes #25985 ClassCastException on MBean initialization for WAR-contained EJBModule by @dmiya3 in #25986
• Fixes #25983 UnsupportedOperationException from bootclasspath-current MBean attribute on modern JDKs by @dmiya3 in #25984

Component Upgrades

• Upgrade jsftemplating to 4.2.0 by @OndroMih in #25977
• Updated dependencies by @dmatej in #25991:
  • Helidon Config to 4.4.1
  • Nimbus JWT to 10.9,
  • JNoSQL to 1.1.13
  • JSch to 2.28.0
  • StAX 2 API to 4.3.0
• Updated dependencies by @dmatej in #25998
  • Grizzly to 5.0.1
  • Grizzly NPN to 2.0.1
  • HK2 to 4.0.1
  • schema2beans-osgi to 2.9.0
  • dbschema-osgi to 2.9.0
  • ant-osgi to 1.17.0
• Updated ORB to 5.0.2 by @dmatej in #25804 and 79e1c0d
• Updated dependencies by @dmatej in #26016
  • OpenMQ to 6.9.0
  • Mojarra to 4.1.9
  • Apache Commons IO to 2.22.0
  • Apache Commons Codec to 1.22.0
  • JBoss Javassist to 3.31.0
  • Jackson to 2.21.3
  • MimePull to 1.11.0
  • JLine to 3.30.12, see
    • https://github.com/jline/jline3/releases/tag/jline-3.30.10
    • https://github.com/jline/jline3/releases/tag/jline-3.30.11
    • https://github.com/jline/jline3/releases/tag/jline-3.30.12
  • Microprofile Config API to 3.1.1
  • PFL to 5.1.1
  • GMBAL to 4.1.2

Maintenance

• Updated Checkstyle + fixed javadoc issues breaking it by @dmatej in #25992
• Fixed URL to the Eclipse project to create a release by @dmatej in #25963
• Update docs and web to clarify that Embedded GlassFish is for production by @OndroMih in #25969
• Reduced complexity in DOL around ordered sets by @dmatej in #25965
• Remove the repackaged Jackson XML Bind annotations by @OndroMih in #25970
• Upgrade maven security plugin to 1.0.21 to support Java 26 by @OndroMih in #25974
• ClusterITest - there are two more ports props by @dmatej in #25976
• Updated readme by @dmatej in #25975
• Updated docs after release of 8.0.1 by @dmatej in #25979
• Fixes NetUtils integration test by @avpinchuk in #25999
• Delete Solaris Realm by @avpinchuk in #26001
• CMP Refactoring by @dmatej in #26002
• Fix a few links in the guides by @OndroMih in #26005
• Extract console-mail-plugin and add button "send test email" (#25997) - port from 7.x by @OndroMih in #26003
• Corba refactoring by @dmatej in #25804

Full Changelog: 8.0.1...8.0.2