Minecraft Servers Get Critical Security Patch and Memory Optimizations
AleForge Minecraft servers now run more securely and efficiently. We have rolled out a mandatory infrastructure-level patch for a critical Java vulnerability, and alongside it, we have completely overhauled how our Minecraft servers handle memory allocation.
Just like the recent optimizations we discussed in project-zomboid-servers-now-use-less-ram.md, your Minecraft server will now actively manage your RAM over the entire life of your world instead of stubbornly hoarding it.
The Security Patch: CVE-2026-91403
A critical Java vulnerability (CVE-2026-91403) makes it possible for an attacker to impersonate a secure website to a Java server. The certificates involved come from compromised certificate authorities (eMudhra) that Java still inherently trusted.
We have successfully rebuilt every Java system image across our infrastructure and completely removed these compromised certificate authorities from Java’s trust store.
You must restart your Java server to apply this fix. A server that stays online will continue to run the old, vulnerable copy of Java in memory.
Streamlining Java Versions
Current Minecraft servers should use Java 25. Older servers should use the newest Java that their version still supports.
As part of this update, the old “Performance” (GraalVM) Java choices have been removed from the panel. For a dedicated Minecraft server, the current standard Temurin image is the faster runtime. The older GraalVM builds we offered were no longer providing a speed upgrade over Temurin for the same Java version.
The Problem with Memory Bloat
Historically, optimal Minecraft server setups (like the famous Aikar’s Flags) demanded a locked heap—meaning the server immediately claimed 100% of your RAM limit at startup and never gave it back. On a shared hosting environment, this hoarding behavior leads to bloated memory usage and leaves no overhead for the operating system, off-heap networking, or chunk generation, frequently resulting in out-of-memory crashes.
How We Fixed It
We have deployed five new, heavily customized startup command presets (Default, Aikar, Aikar Large, ZGC, MeowIce, Java 8). Across all of them, we implemented the following core changes:
- Dynamic Memory Limits: Your plan still sets the maximum memory limit, but Java now uses that limit dynamically (scaling to 85% of your plan’s memory) instead of a fixed heap size. The remaining 15% stays free for chunks, networking, and the rest of Java outside the heap, preventing the server from killing itself when under heavy load.
- Active Memory Deduplication: We enabled String Deduplication and Java 25’s Compact Object Headers. Minecraft creates millions of temporary objects (like dropped items and particles) and text strings (chat, block data). Now, every object gets a smaller header, and duplicate text is stored only once. The same world fits in significantly less RAM.
- Aggressive Memory Recovery: While the server is quiet or empty, the heap shrinks and gives memory back to the host every 5 minutes. An empty server no longer holds its peak RAM until the next restart.
- Optimized Garbage Collection: For standard setups, G1GC now keeps a larger young generation because Minecraft throws away most objects it creates every single tick. Garbage collection starts earlier, keeping collections short and preventing massive lag spikes.
What You Need to Do
Restart your Minecraft server from the AleForge control panel.
New servers will get the optimized Default command automatically. Existing servers will keep their current startup command unless you manually change it in the Startup tab. However, the security fix is baked into the system image, so the restart alone applies the security patch even if you leave your custom startup command alone.
