WildFly 39 is released!

By Brian Stansberry | January 16, 2026

I’m pleased to announce that the new WildFly and WildFly Preview 39.0.0.Final releases are available for download at https://wildfly.org/downloads, The Galleon feature packs for WildFly 39 are available in Maven Central.

New and Notable

Here’s what’s new:

Clustering: We’ve added a couple new things in the clustering/high-availability area:
- WildFly now supports TLS configuration for TCP-based transport protocols. This can be used to effectively replace ASYM_ENCRYPT with AUTH protocols in the existing JGroups stack.
- WildFly now supports idle time-based eviction for distributable HttpSessions. This provides administrators with more flexible resource management options, which is particularly useful when distributed state objects have highly variable sizes. The new configuration allows eviction based on how long a state object has been idle, complementing the existing count-based eviction mechanism.
Jakarta RESTful Web Services: A new attribute, resteasy-original-webapplicationexception-behavior has been added to the jaxrs subsystem. It was previously only available by configuring the equivalent context parameter at a deployment level. Configuring this at the subsystem level will apply it to all deployments, unless the deployment itself explicitly sets the parameter.
Java EE 11 Integration: In WildFly Preview, we’ve updated our implementations of Jakarta Authentication, Jakarta Concurrency, Jakarta Security, Jakarta Servlet, and Jakarta Websockets.
Galleon provisioning: Our Galleon tooling has added preview capabilities that will make it possible for users who want to use a feature pack to choose which of a compatible set of dependency feature packs to use. There’s no practical end-user benefit to this yet, but it will be helpful in the future as the feature packs we produce make use of this capability. A typical example will be letting users of something like the AI feature pack choose which "base" feature pack that provides Jakarta EE to use — wildfly-ee, wildlfy-preview or a planned wildfly-ee-10.
- Note: If you plan to develop a feature pack that depends on WildFly 39, be sure to use WildFly Galleon Plugins 8.1.0 or later. We always recommend you use the same Galleon plugin version that WildFly used to build its own feature packs.
Component Upgrades: We’ve updated a wide range of dependencies to their latest versions, improving performance, stability, and security. Notable upgrades include:
- Jackson 2.20
- Infinispan 16.0
- JGroups 5.5
- Apache Artemis 2.44
- Narayana 7.3
- WildFly Core 31
- WildFly Clustering 9.0
- lz4-java 1.10.1, addressing CVE-2025-12183 and CVE-2025-66566.
- Undertow 2.3.22, addressing CVE-2024-3884, CVE-2024-4027 and CVE-2025-12543.

Supported Specifications

Jakarta EE

Standard WildFly 39 is a compatible implementation of the EE 10 Platform as well as the Web Profile and the Core Profile. WildFly is EE 10 Platform, Web Profile and Core Profile compatible when running on Java SE 17 and Java SE 21.

Evidence supporting our certification is available in the WildFly Certifications repository on GitHub:

Specification	Compatibility Evidence
Jakarta EE 10 Full Platform	SE 17
SE 21
Jakarta EE 10 Web Profile	SE 17
SE 21
Jakarta EE 10 Core Profile	SE 17
SE 21

Specification

Compatibility Evidence

Jakarta EE 10 Full Platform

SE 17

SE 21

Jakarta EE 10 Web Profile

SE 17

SE 21

Jakarta EE 10 Core Profile

SE 17

SE 21

MicroProfile

Standard WildFly 39 supports MicroProfile Platform 7.1, along with several other MicroProfile specifications that are not part of MicroProfile Platform. The full listing is available in the Getting Started Guide.

Compatibility evidence for the specifications that are part of MicroProfile 7.1 can be found in the WildFly Certifications repository on GitHub.

WildFly Preview and EE 11

Since the WildFly 32 release, we have been using WildFly Preview to provide a look at what we’re doing for Jakarta EE 11 support. We continued to make progress on this during the WildFly 39 cycle, with new integrations of implementations of Jakarta Authentication, Jakarta Concurrency, Jakarta Security, Jakarta Servlet and Jakarta Websocket.

For Jakarta Pages we are still offering the EE 10 implementation. Our goal is shift to the EE 11 implementation in WildFly Preview 40.

The Jakarta EE 11 Platform and Web Profile went GA last summer. We are working on completing our implementation of these in WildFly Preview, for eventual incorporation in standard WildFly.

Full details on the EE specification versions provided by WildFly Preview can be found in the WildFly 39 documentation.

Java SE Support

Our recommendation is that you run WildFly 39 on Java SE 21, as that is the latest LTS JDK release where we have completed the full set of testing we like to do before recommending a particular SE version. WildFly 39 also is heavily tested and runs well on Java 17.

Our recommendation of SE 21 over SE 17 is solely because as a general principle we recommend being on later LTS releases, not because of any problems with WildFly on SE 17.

While we recommend using SE 21 or SE 17, we believe WildFly runs well on SE 25, which is the most recent LTS release, released last September. By runs well, I mean the main WildFly nightly testsuite jobs produce results equivalent to what we see with SE 17 and SE 21. We want developers who are trying to evaluate what SE 25 means for their applications to be able to look to WildFly as a useful development platform.

Since SE 25 is an LTS release, we aim in a future WildFly version to include it in the list of recommended SE releases. To do this there is further qualifying work to be done, beyond the good WildFly testsuite results we are seeing today. We’re working to validate the SE 25 compatibility of key components we include in WildFly, and we’re using the Jakarta EE 11 TCK as a further set of tests of how well we run on SE 25. (The EE 11 TCK was not written for SE 25, so there may be some tests that won’t work on it. However, using the EE 10 TCK to help qualify SE 21 worked well.) In both of these areas we made good progress during the WildFly 39 development period.

Please note that WildFly runs in classpath mode.

Incompatible Changes

There are a couple of incompatible changes in WildFly 39 that may affect some users:

The require-host-http11 attribute on undertow subsystem listener resources no longer has any effect. The server behavior is now always as if this were set to true, i.e. we now require that HTTP 1.1 or later requests include a Host header, as is mandated by the HTTP standards. Previously this was configurable and had a default value of false, meaning we did not require such a header. It was reported to us that not requiring this was a security flaw, so we changed this behavior.
Previously, when using HTTP to upload a deployment to our management interface, we imposed no limit on the size of the deployment. Now we impose a limit of 1GB. If you have deployments larger than that, you can use the org.wildfly.management.upload.limit system property to configure a different limit, with a value set to the number of bytes.

Maven Publication Changes

The main WildFly project has begun deploying its release content directly to Maven Central. This is a change from the project’s decades-old practice of deploying to JBoss Nexus, from which our content later would be synced to Maven Central. JBoss Nexus serves as a proxy for Maven Central, so this content will still be available via JBoss Nexus. Our expectation is this change will be transparent to our users. If you encounter problems, please let us know!

New and Noteworthy Contributors

WildFly gets great contributions from so many people. Let’s thank a few of them.

Jian-Fong Yu, Christian Voss and Ilias Bourdakos made their first contributions to the main WildFly repository, while Rafael Rosa made his first contribution to WildFly Core. Thank you, Jian-Fong, Christian, Ilias and Rafael!

Paul Ferraro and Rado Husar did excellent work on our clustering capabilities. Rado was also on fire in general, doing all sorts of the kinds of unsung work that helps keep an OSS project moving. Thank you, Paul and Rado!

Flavia Rainone and Bartosz Baranowski worked very hard to deliver a number of security and other improvements in our web tier for WildFly 39. Thank you, Flavia and Bartosz!

Release Notes

The full WildFly 39 release notes are available in GitHub. Issues fixed in the underlying WildFly Core 30.0.0 and 30.0.1 releases are listed in the WildFly Core JIRA.

Please try it out and give us your feedback, in the WildFly google group, Zulip or JIRA.

Best regards,

Brian