Java Roundup: Apache Camel Fixes 38 CVEs, Payara Closes Two RCEs, Gatherers4j 0.15 and ADK for Java 1.12
InfoQ's roundup for the week of October 12 had more security news than usual. Apache Camel published advisories for 38 CVEs: 13 rated HIGH and 25 rated MEDIUM. Claude found 28 of them through Anthropic's Project Glasswing, and outside security researchers reported the other 10. The fixed releases are Camel 4.23.0, 4.22.1 and 4.18.5, depending on which release line you run. Camel sits inside a lot of integration middleware, so even teams that never added it directly should check their transitive dependencies.
Azul Payara 7.5.0 (the October 2026 edition) ships as Community Edition 7.2026.10 and Enterprise Editions 6.43.0 and 5.92.0. It fixes two remote code execution flaws. CVE-2026-2586 can be exploited through the Administration Console to run OS commands as the service user. CVE-2026-2587 is reached through server-side template rendering and could lead to host compromise. The release also lets SSH nodes run without elevated permissions and adds delete-jvm-option and delete-system-properties for command-line configuration.
On the library side, Gatherers4j 0.15.0 adds stream gatherers for statistics: movingStatistics(), runningStatistics() and their By variants each emit a StatisticalSummary record per element. It also adds movingWeightedMean() with linear or custom weights. Google ADK for Java 1.12.0 adds workflow graph types (the Node interface, BaseNode, Start and an Edge record) and deprecates maxInvocations in ContextCacheConfig. ADK for Kotlin 1.4.0 adds an EdgesDsl and a ChatCompletions backend for OpenAI-compatible endpoints. Yupiik Fusion 1.2.0 has a breaking change: HandlebarsCompiler now behaves more like Handlebars.js.
Read more — InfoQ
TornadoVM 7.3 Adds a cuTile CUDA Backend, NVIDIA Library Calls and Multi-GPU Execution
TornadoVM, the open-source framework that offloads Java code to GPUs, has reached version 7.3. It runs on JDK 21, 25, 26 and 27 next to a standard JVM (OpenJDK, GraalVM, Temurin or Zulu), so you don't need a custom runtime. The 7.x line finishes an architectural cleanup: backends use the Foreign Function & Memory API instead of JNI, the experimental JVMCI dependency is gone, and compiler metadata goes through a single reflection, ASM and Unsafe layer on every supported JDK.
The new backend work targets NVIDIA hardware. An optimized CUDA backend supports the cuTile programming model through a new TileContext. TaskGraphs can now call CUDA libraries such as cuBLAS and CUTLASS directly, so you can swap a JIT-generated kernel for a tuned library call, chain several calls, or mix both in one graph. The hybrid API gives the same library access for Apple's MXL. This release also adds multi-GPU execution. OpenCL and Apple Metal remain compilation targets for Java source.
TornadoVM now has four programming styles: the loop-parallel annotation API, a kernel-context API for finer control, TileContext, and the hybrid library API. Integrations include Quarkus, Flink and Spring AI. In the Flink integration, you mark a Table API query with a configuration flag, and at execution time a library provider inspects the query's intermediate representation and decides whether to run it on the GPU. The team also released jitLLM 2.0, a Java inference engine built on TornadoVM that ships as a single JAR and is aimed at the same use cases as llama.cpp and Ollama.
Read more — InfoQ
Reflect, Transform, Accelerate: Project Babylon's HAT Compiles Java Code Models to CUDA and OpenCL
In a Devoxx Belgium 2026 talk published on Inside Java, Juan Fumero walked through the Heterogeneous Accelerator Toolkit (HAT). HAT is a parallel programming framework built on code reflection from OpenJDK Project Babylon. Where TornadoVM works on bytecode, HAT uses Babylon's code reflection API to turn annotated Java compute code into a code model that can be analyzed and rewritten.
HAT works in three stages. First it reflects the Java method into a code model. Then it transforms that model into a GPU-friendly form. Finally it offloads the selected computations to OpenCL or CUDA. The talk's examples are tensor-core programming and matrix multiplication, the operations behind most AI and NLP inference. It also shows how to profile and tune the generated CUDA kernels with NVIDIA Nsight Compute and Nsight Systems.
Babylon is still an OpenJDK research project, not a targeted JEP, so HAT is not something to adopt in production yet. The talk is a good introduction to code reflection for developers who haven't used it. Code reflection is the mechanism Babylon proposes for running Java on GPUs, translating it to SQL, or differentiating it, all without leaving the language.
Read more — Inside Java
Links & Sources
You May Also Enjoy
