The "hack" word appears in:

src/jdk.crypto.mscapi/windows/classes/sun/security/mscapi/CSignature.java:587: // hack for working around API bug
src/jdk.crypto.mscapi/windows/classes/sun/security/mscapi/CSignature.java:594: // hack for working around API bug

src/java.base/share/classes/sun/security/rsa/RSAPSSSignature.java:357: // hack for working around API bug
src/java.base/share/classes/sun/security/ssl/SSLTransport.java:111: // Hack code to deliver SSLv2 error message for SSL/TLS connections.
src/java.base/share/classes/sun/security/util/CurveDB.java:91: // This is a hack to allow SunJSSE to work with 3rd party crypto