Eclipse Foundation Eclipse Openj9 vulnerabilities
7 known vulnerabilities affecting eclipse_foundation/eclipse_openj9.
Total CVEs
7
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL1HIGH4MEDIUM2
Vulnerabilities
Page 1 of 1
CVE-2026-111074P3HIGHCVSS 8.7≥ 0.8.0, < 0.632026-10-21
CVE-2026-111074 [HIGH] CWE-190 CVE-2026-111074: In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentic
In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remote denial of service. When processing the initial 4-byte length field of an incoming TCP connection, an integer overflow in `MessageBuffer::computeRequiredCapacity()` causes the receiving compilation worker thread to enter an infinite loop c
nvd
CVE-2026-110938P3HIGHCVSS 8.7≥ 0.8.0, < 0.632026-10-21
CVE-2026-110938 [HIGH] CWE-20 CVE-2026-110938: In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service
In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper boundary checks during protocol message and reply handling. An unauthenticated remote attacker or malicious JITServer can transmit malformed network payloads that cause out-of-bounds heap reads, immediately crashing the JITServer daemon
nvd
CVE-2026-111075P3HIGHCVSS 8.7≥ 0.8.0, < 0.632026-10-21
CVE-2026-111075 [HIGH] CWE-125 CVE-2026-111075: In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field val
In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled `_size`, `_paddingSize`, and `_dataOffset` fields during `DataDescriptor` message deserialization. An unauthenticated remote attacker can send a crafted network payload that triggers an unsigned integer underflow in `Dat
nvd
CVE-2026-6918P3HIGHCVSS 7.5≥ 0.21, < 0.592026-05-05
CVE-2026-6918 [HIGH] CWE-125 CVE-2026-6918: In Eclipse Open9J versions 0.21 to 0.58, a pre-authentication remote attacker can crash JITServer by
In Eclipse Open9J versions 0.21 to 0.58, a pre-authentication remote attacker can crash JITServer by sending a 32-byte crafted TCP message.
nvd
CVE-2023-2597P3CRITICALCVSS 9.1≥ unspecified, ≤ 0.37.02023-05-22
CVE-2023-2597 [CRITICAL] CWE-120 CVE-2023-2597: In Eclipse Openj9 before version 0.38.0, in the implementation of the shared cache (which is enabled
In Eclipse Openj9 before version 0.38.0, in the implementation of the shared cache (which is enabled by default in OpenJ9 builds) the size of a string is not properly checked against the size of the buffer.
nvd
CVE-2026-16440P4MEDIUMCVSS 5.7≥ 0.8.0, < 0.602026-08-19
CVE-2026-16440 [MEDIUM] CWE-674 CVE-2026-16440: In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a
In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a segmentation fault.
nvd
CVE-2026-97400P4MEDIUMCVSS 6.8≥ 0.8.0, < 0.632026-10-20
CVE-2026-97400 [MEDIUM] CWE-611 CVE-2026-97400: In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview t
In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an arbitrary local file named inside the bundle and send its contents to an arbitrary remote host.
nvd