back to all blogsSee all blog posts

Configurable quiesce timeout and security enhancements in Open Liberty 26.0.0.11

image of author
Arjun Aravind on Nov 3, 2026
announcements , release , security ,
Post available in languages:

Open Liberty 26.0.0.11 gives server administrators direct control over the graceful shutdown period with a new quiesceTimeout attribute on the <server> element. This eliminates the previous hardcoded 30-second limit that could abruptly interrupt long-running workloads during shutdown. This release also adds validation for form login error page redirects to external hosts.

In Open Liberty 26.0.0.11:

Along with the new features and functions added to the runtime, we’ve also made updates to our guides.

View the list of fixed bugs in 26.0.0.11.

Try it now in 26.0.0.11

Check out previous Open Liberty GA release blog posts.

Configurable quiesce timeout on the server element

When you stop an Open Liberty server, it enters a quiesce phase—a grace period during which it waits for active work to finish before the JVM exits. During this phase, Liberty notifies registered shutdown listeners, allowing features to drain connections and complete in-flight requests, and then waits for any remaining active threads in the executor service to finish. Previously, this grace period was hardcoded to 30 seconds with no way to adjust it. For teams running workloads with long-lived requests—such as batch jobs, large file transfers, or complex transactions—30 seconds was often insufficient, leaving work abruptly interrupted at shutdown.

You can now configure the quiesce grace period to any value of 30 seconds or greater by using the quiesceTimeout attribute on the <server> element in your server.xml file.

Two-stage shutdown sequence

The configured timeout governs a two-stage shutdown sequence:

  1. Pre-phase listeners — Liberty first notifies pre-phase ServerQuiesceListener components, such as the channel framework, which stops inbound network connections. These listeners have the full configured timeout available to them.

  2. Default-phase listeners and thread drain — Liberty then notifies default-phase listeners, which drain in-flight application work, and waits for active threads in the shared executor service to finish. These share whatever time remains from the original budget.

If pre-phase listeners consume more than half of the configured timeout, Liberty grants the default-phase listeners a fresh window equal to half the configured timeout, rather than the remaining time. This means the actual elapsed shutdown time can be up to 1.5× the configured value. If your application code must complete within a strict wall-clock deadline at shutdown, set quiesceTimeout conservatively enough to account for this behaviour.

Configuration

Add the quiesceTimeout attribute to the <server> element in your server.xml file:

<server quiesceTimeout="2m">
    <!-- your existing configuration -->
</server>

The value uses Liberty’s standard duration syntax — specify a positive integer followed by a time unit: h (hours), m (minutes), s (seconds), or ms (milliseconds). You can also combine units:

<!-- 2 minutes -->
<server quiesceTimeout="2m">

<!-- 90 seconds — two equivalent forms -->
<server quiesceTimeout="1m30s">
<server quiesceTimeout="90s">

<!-- plain integer is interpreted as seconds -->
<server quiesceTimeout="120">

The minimum allowed value is 30s. Values less than this threshold, or values that cannot be parsed, fall back to the default of 30 seconds and log warning message CWWKG0111W.

The timeout can be updated dynamically. If you change it in server.xml while the server is running, the next shutdown automatically uses the new value without requiring a server restart.

For Beta users: In the beta release, this attribute was configured on the <executor> element (for example, <executor quiesceTimeout="1m30s"/>). In 26.0.0.11, it is configured on <server> element. Update your server.xml accordingly.

Shutdown log messages

When the server begins quiescing, it logs an audit message CWWKE1100I, which displays the configured timeout:

CWWKE1100I: Waiting for up to 120 seconds for the server to quiesce.

On a clean shutdown, message CWWKE1101I follows:

CWWKE1101I: Server quiesce complete.

If the timeout expires before all listeners and threads finish, Liberty proceeds with shutdown and logs the following messages:

CWWKE1102W: The quiesce operation did not complete. The server will now stop.
CWWKE1106W: 2 shutdown operations did not complete during the quiesce period. ...
CWWKE1107W: A total of 3 threads did not complete during the quiesce period.

CWWKE1102W is the signal to increase quiesceTimeout. The accompanying CWWKE1106W and CWWKE1107W messages identify specifically which listeners and how many threads were still running, providing the information needed to choose an appropriate value.

For more information, see the Liberty server element configuration reference and Configuring Liberty server shutdown.

Additional validation for form login error page redirects

Open Liberty now blocks form login error page redirects to external hosts unless the target host is listed in the wasReqURLRedirectDomainNames attribute of the <webAppSecurity/> element. This validation is consistent with the existing check that is applied to WASReqURL redirects.

This change applies whenever you specify a form login error page using either the error_page request parameter or the loginErrorURL attribute of the <webAppSecurity/> element in your server.xml file. The host in the error page URL must match either the host of the current login request or a host that is listed in the wasReqURLRedirectDomainNames attribute of the <webAppSecurity/> element. Otherwise, the redirect to the external host is blocked, and Liberty logs the error message CWWKS9134E. To allow the redirect, add the trusted host to this attribute.

For more information, see the webAppSecurity configuration element.

Security vulnerability (CVE) fixes in this release

CVE CVSS Score Vulnerability Assessment Versions Affected Notes

CVE-2026-101294

8.7

Improper verification of cryptographic signature

17.0.0.3-26.0.0.10

Affects the openidConnectClient-1.0, openidConnectServer-1.0, socialLogin-1.0, jwt-1.0, and jwtSso-1.0 features

CVE-2026-103320

4.3

Information disclosure

17.0.0.3-26.0.0.10

Affects the restConnector-2.0 feature

CVE-2026-103499

7.5

Denial of service

17.0.0.3-26.0.0.10

Affects the servlet-3.1, servlet-4.0, servlet-5.0, servlet-6.0, and servlet-6.1 features

CVE-2026-105442

7.5

Denial of service

17.0.0.3-26.0.0.10

Affects the messagingServer-3.0 and wasJmsServer-1.0 features

CVE-2026-108284

6.5

Information disclosure

17.0.0.3-26.0.0.10

Affects the restConnector-2.0 feature

CVE-2026-10844

4.3

Open redirect

17.0.0.3-26.0.0.10

Affects the appSecurity-1.0, appSecurity-2.0, appSecurity-3.0, appSecurity-4.0, appSecurity-5.0, and appSecurity-6.0 features

CVE-2026-11547

4.3

Server-side request forgery

17.0.0.3-26.0.0.10

Affects the adminCenter-1.0 feature

CVE-2026-17615

7.5

Improper restriction of XML external entity reference

17.0.0.3-26.0.0.10

Affects the restfulWS-3.0, restfulWS-3.1, and restfulWS-4.0 features

CVE-2026-76646

7.5

Denial of service

17.0.0.3-26.0.0.10

Affects the jsf-2.2, faces-3.0, faces-4.0, and faces-4.1 features

CVE-2026-78636

4.3

Information disclosure

17.0.0.3-26.0.0.10

Affects the restConnector-2.0 feature

CVE-2026-93895

9.1

Authorization bypass

17.0.0.3-26.0.0.10

Affects the grpc-1.0 feature

CVE-2026-93905

8.2

Deserialization of untrusted data

17.0.0.3-26.0.0.10

Affects the batchManagement-1.0 feature

CVE-2026-93909

9.1

Authentication bypass

17.0.0.3-26.0.0.10

Affects the samlWeb-2.0 feature

For a list of past security vulnerability fixes, reference the Security vulnerability (CVE) list.

Notable bugs fixed in this release

We’ve spent some time fixing bugs. The following sections describe just some of the issues resolved in this release. If you’re interested, here’s the full list of bugs fixed in 26.0.0.11.

New and updated guides since the previous release

As Open Liberty features and functionality continue to grow, we continue to add new guides to openliberty.io on those topics to make their adoption as easy as possible. Existing guides also receive updates to address any reported bugs/issues, keep their content current, and expand what their topic covers.

  • Data Persistence with Jakarta Data

    Learn how to use Jakarta Data to store data and query it using methods named by convention, annotation-driven queries, and the Jakarta Data Query Language (JDQL).

Develop and run your apps using 26.0.0.11

If you’re using Maven, include the following in your pom.xml file:

<plugin>
    <groupId>io.openliberty.tools</groupId>
    <artifactId>liberty-maven-plugin</artifactId>
    <version>3.12.4</version>
</plugin>

Or for Gradle, include the following in your build.gradle file:

buildscript {
    repositories {
        mavenCentral()
    }
    dependencies {
        classpath 'io.openliberty.tools:liberty-gradle-plugin:4.0.3'
    }
}
apply plugin: 'liberty'

Or if you’re using container images:

FROM icr.io/appcafe/open-liberty

Or take a look at our Downloads page.

If you’re using IntelliJ IDEA, Visual Studio Code or Eclipse IDE, you can also take advantage of our open source Liberty developer tools to enable effective development, testing, debugging and application management all from within your IDE.

Ask a question on Stack Overflow

Get Open Liberty 26.0.0.11 now

Available through Maven, Gradle, Docker, and as a downloadable archive.