8.7
High
CVE-2026-110938 In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper…
Description
In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper boundary checks during protocol message and reply handling. An unauthenticated remote attacker or malicious JITServer can transmit malformed network payloads that cause out-of-bounds heap reads, immediately crashing the JITServer daemon or client JVM process via a segmentation fault (SIGSEGV).
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Eclipse OpenJ9 0.8 | 0.8.0 → < 0.63 | 0.63 |
References
- github.com github.com
- gitlab.eclipse.org gitlab.eclipse.org
- gitlab.eclipse.org gitlab.eclipse.org
- gitlab.eclipse.org gitlab.eclipse.org
- gitlab.eclipse.org gitlab.eclipse.org
- gitlab.eclipse.org gitlab.eclipse.org
Timeline
- Published
- Last modified
Other CVEs of Eclipse OpenJ9
The 7 CVEs of Eclipse OpenJ9 →
CVE-2026-111075
In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on…
8.7
High
CVE-2026-111074
In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remote…
8.7
High
CVE-2026-97400
In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent…
6.8
Medium
CVE-2026-16440
In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a segmentation fault
5.7
Medium