Eclipse GlassFish is an application server, implementing Jakarta EE and MicroProfile. This release corresponds with the Jakarta EE 11 specification. Eclipse GlassFish 8 is production ready, commercially supported by OmniFish, and requires JDK 21 or higher.

Release Overview

Version 8.0.4 focuses on the upgrade path from GlassFish 7, on Embedded GlassFish, and on CDI integration. It also bring huge Jakarta Faces rendering performance improvements with an upgraded Mojarra, which now renders pages 3 times faster than before.

Domains created by GlassFish 7.0.x now have their legacy JKS/JCEKS security stores migrated to PKCS12, upgrading a domain that contains a cluster works again, and the migrated domain-passwords.p12 is synchronized to the instances.

Embedded GlassFish propagates deployment failures, deletes its temporary directories through a JVM shutdown hook and restricts them to the current user, and ships real javadoc and sources Maven artifacts.

Jakarta REST artifacts can be injected with @Inject out of the box now that jersey-cdi-rs-inject is bundled, @Transactional rollbackOn/dontRollbackOn carried by CDI stereotypes are resolved, and the thread-context-classloader hack in the Weld bean deployment archive has been replaced by the per-BDA ResourceLoader SPI.

In Mojarra 4.1.10, the Mojarra team performed a series of performance tests and profiling runs and implemented several performance optimizations in Jakarta Faces page rendering. As a result, the final benchmark shows that GlassFish 8.0.4 with the new Mojarra version perfoms about 3 times faster than the previous version. The numbers also prove that GlassFish renders Jakarta Faces pages equally fast as other servers like WildFly, Payara or Tomcat. They also show that using Mojarra is now faster than using MyFaces on any server, even after several recent performance improvements in Myfaces inspired by the improvements in Mojarra. You can read more about it in this article by a core Mojarra team member Bauke Scholtz.

Upgrading from GlassFish 7.0.x

Upgrading a domain from GlassFish 7.0.x migrates its legacy JKS/JCEKS security stores to PKCS12, so no manual conversion of the domain keystore and truststore is needed. Domains that contain a cluster upgrade correctly again, and the resulting domain-passwords.p12 is synchronized to the instances.

• Migrate legacy JKS/JCEKS security stores to PKCS12 when upgrading from 7.0.x by @renatsaf in #26109
• Fix upgrade if the domain contains a cluster by @OndroMih in #26151
• Sync domain-passwords.p12 to instances after PKCS12 migration by @renatsaf in #26103

Security Fixes

• CVE-2026-12605, 9.6 CRITICAL - CSRF + SSRF leaks the admin tocken if the victim is authenticated into the Admin Console
• CVE-2026-59889, 6.5 MEDIUM - jackson-databind: @JSONVIEW bypassed for @JsonUnwrapped container properties on deserialization
• CVE-2026-54515, 5.3 MEDIUM - jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties

A complete GlassFish security summary is provided by OmniFish here: https://omnifish.ee/glassfish-security-summary/

Known Issues

• Startup of GlassFish starts much slower on some systems, especially on Mac OS: #26185 - a workaround is to set the AS_HOSTNAME environment variable to localhost or any other hostname that matches the system. This is introduced by improvements in the automatic hostname resolution in GlassFish 8.0.4. It will be fixed in GlassFish 8.0.5 where we decided to remove the whole automatic hostname resolution algorithm, in #26175. This will improve the startup time compared to GlassFish 8.0.3 and will make the behavior simpler and more deterministic.

Fixes

• Propagate deployment failures and fix CDI/assembly issues in GlassFish Embedded by @renatsaf in #26070
• Restore support of domain lib/ext jars by adding them to the server classpath (Fixes #26058) by @renatsaf in #26060
• Resolve @transactional rollbackOn/dontRollbackOn carried by CDI stereotypes by @renatsaf in #26059
• Fix JNDI validation failure for app-scoped resources on server restart by @renatsaf in #26145
• Guard ManagedConnection cleanup against a torn-down physical connection by @renatsaf in #26104
• Fixed hostname autodetection - resolvable by @dmatej in #26037
• Fixed #26000 - config.bat issues by @dmatej in #26158
• Remove superfluous parameter from Admin GUI downloads by @pdudits in #26081

Improvements

• Bundle jersey-cdi-rs-inject to allow @Inject of Jakarta REST artifacts by @renatsaf in #26079
• Delete embedded GlassFish temporary directories via a JVM shutdown hook and restrict them to the current user by @renatsaf in #26069
• Generate real javadoc and sources Maven artifacts for embedded distributions (#24278) by @renatsaf in #26099
• Improve diagnostics for unresolved ejb-ref JNDI lookups by @renatsaf in #26101
• Switch from legacy JVM diagnostic logging to unified logging by @renatsaf in #26056
• Remove thread-context-classloader hack in Weld BDA; rely on per-BDA ResourceLoader SPI by @renatsaf in #26090
• Autodeployer and FileArchive improvements by @dmatej in #26154

Optimizations

• Allocate ServletRequestAttributeEvent lazily in Request by @BalusC in #26147

Component Upgrades

• Updated parent, plugins and dependencies by @dmatej in #26156
• Upgrade Jackson 2.22.0 -> 2.22.1 by @OndroMih in #26141
• Upgrade Mojarra 4.1.9 -> 4.1.12
• Metro WSIT 4.0.6 -> 4.0.7
• Helidon Config 4.4.1 -> 4.5.1
• EclipseLink 5.0.0 -> 5.0.1
• JNoSQL 1.1.14 -> 1.1.15
• Jettison 1.5.5 -> 1.5.7
• JLine 4.1.3 -> 4.3.1
• FasterXML/woodstox 7.2.0 -> 7.2.1
• Commons Codec 1.22.0 -> 1.22.1
• Javassist 3.31.0 -> 3.32.0
• JNA 5.19.0 -> 5.19.1
• Jsch 2.28.2 -> 2.28.6

Maintenance

• Replace deprecated new URL constructors by @renatsaf in #26051
• Issue #25903 Removal of the CachedPermission - dead code by @dmatej in #26159
• Avoid going through Optional by @pzygielo in #26138
• Use default value for .publish by @pzygielo in #26139
• Include ORB repositories by @pzygielo in #26140
• Fixed #26004 - Felix plugin knows well what to do by @dmatej in #26157
• Reducing amount of occupied disk space for PRs by @dmatej in #26125
• Resolving problems with Jenkins by @dmatej in #26155
• Fixed pattern for hostname - unit test failed in docker container by @dmatej in #26161

Documentation

• Remove outdated OSGi Web Console instructions from the Administration Guide by @renatsaf in #26080
• Document that add/remove-library for domain/lib doesn't require restart by @OndroMih in #26110
• Document class loader delegation exceptions and the useBundledJsf property by @renatsaf in #26091
• Formatting in "The Server Lifecycle Event Context" section by @pzygielo in #26122
• Avoid dummy and duplicates in docs-pdfs archive by @pzygielo in #26123

New Contributors

• @pdudits made their first contribution in #26081

Full Changelog: 8.0.3...8.0.4