oracle/graal · error · SecurityException

Sealing violation: package %s is sealed

Error message

Sealing violation: package %s is sealed

What it means

Ported from java.net.URLClassLoader.getAndVerifyPackage: when defining a class, the loader checks the package it belongs to. If the package is already sealed (Sealed attribute in the manifest of the jar that first defined it) and the new class comes from a different code source URL, this SecurityException is thrown — a sealed package may not be extended from another jar.

Source

Thrown at compiler/src/jdk.graal.compiler.hostvmaccess/src/jdk/graal/compiler/hostvmaccess/HostVMAccessClassLoader.java:501

            CodeSource cs = new CodeSource(url, signers);
            return defineClass(name, bb, cs);
        } else {
            byte[] b = res.getBytes();
            CodeSigner[] signers = res.getCodeSigners();
            CodeSource cs = new CodeSource(url, signers);
            return defineClass(name, b, 0, b.length, cs);
        }
    }

    /**
     * See {@code java.net.URLClassLoader#getAndVerifyPackage}.
     */
    private Package getAndVerifyPackage(String pkgname, Manifest man, URL url) {
        Package pkg = getDefinedPackage(pkgname);
        if (pkg != null) {
            if (pkg.isSealed()) {
                if (!pkg.isSealed(url)) {
                    throw new SecurityException("Sealing violation: package " + pkgname + " is sealed");
                }
            } else {
                if ((man != null) && isSealed(pkgname, man)) {
                    throw new SecurityException("Sealing violation: can't seal package " + pkgname + ": already loaded");
                }
            }
        }
        return pkg;
    }

    /**
     * See {@code java.net.URLClassLoader#definePackage}.
     */
    private Package definePackage(String name, Manifest man, URL url) {
        String specTitle = null;
        String specVersion = null;
        String specVendor = null;
        String implTitle = null;

View on GitHub (pinned to a66e9ccd1d)

Solutions

1. Remove the duplicate/patch jar that adds classes to the sealed package
2. Un-seal the package: edit the first jar's manifest (remove 'Sealed: true') if you own it
3. Repackage the extra classes under a different package name

Example fix

# before
classpath: vendor-core.jar        # manifest: Sealed: true for com.vendor.pkg
classpath: vendor-patch.jar      # adds com.vendor.pkg.Extra -> SecurityException

# after
classpath: vendor-core.jar       # patch removed; Extra moved to com.vendor.patchpkg

static void checkNoSealedConflict(List<Path> classpath) throws IOException {
    Map<String, Boolean> sealed = new HashMap<>();
    for (Path jar : classpath) {
        try (JarFile jf = new JarFile(jar.toFile())) {
            Manifest man = jf.getManifest();
            if (man == null) continue;
            Attributes main = man.getMainAttributes();
            boolean jarSealed = Boolean.parseBoolean(main.getValue("Sealed"));
            for (String attrName : new String[]{"Sealed"}) { /* also per-entry attrs */ }
            // record package->sealed and detect cross-jar conflicts for shared packages
        }
    }
}

catch (SecurityException e) { if (e.getMessage().contains("is sealed")) { identify the two jars sharing the package from your class path order and remove the patch jar; } }

When it happens

Trigger: A class-path jar's manifest seals package P (Sealed: true); a later class from a different class-path entry tries to define another class in the same package P. getAndVerifyPackage detects pkg.isSealed() && !pkg.isSealed(url).

Common situations: Two jars on the image-build class path sharing a package where one seals it (common with signed vendor jars and 'patch' jars that add classes to the vendor's package); deploying a newer version fragment alongside an older sealed jar.

Related errors

• Sealing violation: can't seal package %s: already loaded
• Given URI '%s' cannot be expressed as URL.
• Type with name %s not found.
• %s is not an enum type
• SpectrePHTBarriers can be set to 'AllTargets' if and only if

AI-assisted analysis of oracle/graal@a66e9ccd1d (2026-08-14). Data as JSON: /api/errors/f5e01c0c7c1fa8be. Report an issue: GitHub.