Eclipse OpenJ9 CVE-2026-111074

Exploitation requires the target to be running in OpenJ9 JITServer mode (remote compilation server) with its TCP listening socket reachable by the attacker; this is an optional, non-default architecture rather than standard in-process JIT, which is the primary limiting factor. Given AV:N/AC:L/PR:N/UI:N, once the port is reachable there is no authentication, user interaction, or special timing required - any remote attacker can send the malformed 4-byte length prefix. Impact is confined to denial of compilation service (availability) for connected client JVMs; it does not grant data access or code execution. Vulnerable versions are those prior to 0.63.0.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, pre-authentication flaw, and the vendor-assigned base score of 8.7 (High) is driven entirely by availability impact (VA:H) with no confidentiality or integrity impact (VC:N/VI:N) - consistent with a pure denial-of-service condition rather than code execution. This is a genuine, easy-to-trigger DoS against any exposed JITServer, but its real-world priority is bounded by two factors not reflected in the raw score: no EPSS probability, CISA KEV entry, or public exploit was provided in the input, so there is 'no public exploit identified at time of analysis' and no evidence of active exploitation; and the impact is limited to loss of compilation service availability, not host compromise. Crucially, exploitation requires the optional JITServer architecture to be deployed and its TCP port reachable by the attacker - a non-default, specialized configuration - so the effective attack surface is far narrower than AV:N alone implies. A fix is confirmed to exist (PR #25008 adds a 1 GB message-size sanity check), which supports patch-based remediation. Net: a legitimate high-severity availability bug for organizations running JITServer, but not a mass-exploitation emergency absent any exploitation signal.

An unauthenticated attacker who can reach the JITServer's TCP listening port opens a small number of connections, each sending a crafted 4-byte length prefix that triggers an integer overflow in MessageBuffer::computeRequiredCapacity(), driving the handling compilation worker thread into a ~100% CPU infinite loop. With only a few such connections the attacker exhausts the entire worker thread pool, silently stopping remote JIT compilation for all connected client JVMs. No public exploit code was identified in the provided data, but the low attack complexity and absence of authentication make weaponization straightforward.