CVE-2026-110938
Eclipse OpenJ9: JITServer: Multiple Denial of Service vulnerabilities via out-of-bounds heap reads during message and reply parsing
Eclipse Foundation Eclipse OpenJ9
CVSS
8.7HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.41%Chance of exploitation activity in the next 30 days, higher than 34% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 0.63Eclipse OpenJ9CVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper boundary checks during protocol message and reply handling. An unauthenticated remote attacker or malicious JITServer can transmit malformed network payloads that cause out-of-bounds heap reads, immediately crashing the JITServer daemon or client JVM process via a segmentation fault (SIGSEGV).
Text from CVE List
Affected versions 1
- Eclipse OpenJ9affected: 0.8.0 before 0.63CVE List
References 6
- gitlab.eclipse.org/security/vulnerability-reports/-/work_items/943Advisoryvia CVE List
- gitlab.eclipse.org/security/vulnerability-reports/-/work_items/944Advisoryvia CVE List
- gitlab.eclipse.org/security/vulnerability-reports/-/work_items/946Advisoryvia CVE List
- gitlab.eclipse.org/security/vulnerability-reports/-/work_items/947Advisoryvia CVE List
- gitlab.eclipse.org/security/cve-assignment/-/work_items/407Advisoryvia CVE List
- github.com/eclipse-openj9/openj9/pull/25011Referencevia CVE List