Skip to main content

Eclipse OpenJ9 CVE-2026-16440

| EUVDEUVD-2026-62368 MEDIUM
Uncontrolled Recursion (CWE-674)
2026-08-19 eclipse GHSA-jxfm-5353-qwhv
Information Disclosure Eclipse Openj9
5.7
CVSS 4.0 · Vendor: eclipse
Share

Severity by source

Vendor (eclipse) PRIMARY
5.7 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.7 MEDIUM

Class file is network-deliverable but requires low privilege to supply and user interaction to load; crash produces high availability loss with no confidentiality or integrity impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
SUSE
MEDIUM
qualitative
Red Hat
5.7 MEDIUM
qualitative

Primary rating from Vendor (eclipse).

CVSS VectorVendor: eclipse

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
A
Scope
X

Lifecycle Timeline

3
Patch available
Aug 19, 2026 - 11:01 EUVD
Source Code Evidence Fetched
Aug 19, 2026 - 10:52 vuln.today
Analysis Generated
Aug 19, 2026 - 10:52 vuln.today

DescriptionCVE.org

In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a segmentation fault.

AnalysisAI

Eclipse OpenJ9 JVM versions through 0.60 crash with a segmentation fault when processing a crafted .class file containing deeply nested annotations, enabling a denial-of-service attack against any Java application running on OpenJ9 where an attacker can supply class files for loading. The vulnerability is rooted in uncontrolled recursion (CWE-674) within the bytecode utility annotation parser, which exhausts the OS thread stack without triggering a recoverable error path. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The target system must be running Eclipse OpenJ9 version 0.60 or earlier - this vulnerability does not affect other JVM implementations such as OpenJDK HotSpot. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 5.7 (AV:N/AC:L/AT:P/PR:L/UI:A) appropriately captures a medium-severity availability-only issue: while the crash is theoretically network-reachable, it requires a low-privileged actor to supply a class file and an active interaction to trigger loading, plus specific structural attack requirements (AT:P) tied to annotation nesting depth. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade Eclipse OpenJ9 to a version beyond 0.60 once a tagged patched release is available; the upstream fix has been implemented in PR #24572 (https://github.com/eclipse-openj9/openj9/pull/24572), but a specific released patched version was not independently confirmed at the time of this analysis - monitor the security advisory at https://github.com/eclipse-openj9/openj9/security/advisories/GHSA-ch6r-v7rg-4jqx for the confirmed release. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Eclipse Openj9

View all
CVE-2026-6918 HIGH
8.7 May 05

Remote unauthenticated attackers can crash Eclipse OpenJ9 JITServer instances (versions 0.21-0.58) by sending a speciall

Same weakness CWE-674 – Uncontrolled Recursion

View all
CVE-2019-9545 HIGH POC
8.8
CVE-2019-9543 HIGH POC
8.8
CVE-2019-9144 HIGH POC
8.8
CVE-2019-9143 HIGH POC
8.8
CVE-2026-9769 HIGH POC
8.7
CVE-2026-40345 HIGH POC
8.2
CVE-2025-9624 HIGH POC
8.3
CVE-2019-9192 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Legacy 15 SP7 Not-Affected

Share

CVE-2026-16440 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy