sun.misc.IOUtils is a JDK internal convenience utility class that provides a single method that offers bulk blocking InputStream read semantics. In 9, java.io.InputStream has been retrofitted with two methods that provide similar, but not quite the same, functionality, readNBytes and readAllBytes, see JDK-8080835.

There are a number of places where IOUtils can be replaced with the appropriate supported API, readNBytes or readAllBytes.

There are a number of places, mainly in the security implementation, that required to read a specific number of bytes ( not to end of stream ), where it is preferable to not preallocate the byte[] and allow it to "grow" lazily, to be defensive against protocol errors. These cases cannot use read[N|All]Bytes, so it makes sense to retain IOUtils but locate it in a package, sun.security.util, that makes it clear who its primary consumer is.