CVE-2026-97400

published 2026-10-20

CVE-2026-97400: In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's…

Priority P4 31 medium 6.8 CVSS 4.0

AV L AC L AT N PR N UI A VC H VI L VA L SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an arbitrary local file named inside the bundle and send its contents to an arbitrary remote host.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
eclipse_foundation	eclipse_openj9	>= 0.8.0 < 0.63	0.63

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-611 CWE-618