Which versions of Eclipse OpenJ9 are affected by CVE-2026-6918?

Eclipse OpenJ9 JITServer versions 0.21-0.58 contain a remote denial-of-service vulnerability allowing unauthenticated attackers to crash JIT compilation services with a 32-byte network message,…. A patch is available.

How to fix or mitigate CVE-2026-6918?

Within 24 hours: Identify all OpenJ9 JITServer instances in versions 0.21-0.58 across development, test, and production environments using asset discovery or deployment tools. Within 7 days: Isolate or restrict network access to vulnerable JITServer endpoints via firewall rules to limit exposure to trusted hosts only; document all affected systems and their criticality. Within 30 days: Monitor Eclipse OpenJ9 project releases for patched versions beyond 0.58; upgrade all instances to a patched release immediately upon availability, beginning with production systems.

Eclipse OpenJ9 CVE-2026-6918

Q: What is the CVSS score of CVE-2026-6918?

CVE-2026-6918 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-27315 HIGH

Out-of-bounds Read (CWE-125)

2026-05-05 eclipse

Information Disclosure Buffer Overflow Eclipse Openj9

8.7

CVSS 4.0 · Vendor: eclipse

Severity by source

Vendor (eclipse) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

SUSE

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (eclipse).

CVSS VectorVendor: eclipse

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

May 05, 2026 - 14:01 EUVD

Source Code Evidence Fetched

May 05, 2026 - 13:30 vuln.today

Analysis Generated

May 05, 2026 - 13:30 vuln.today

CVSS changed

May 05, 2026 - 13:22 NVD

8.7 (HIGH)

DescriptionCVE.org

In Eclipse Open9J versions 0.21 to 0.58, a pre-authentication remote attacker can crash JITServer by sending a 32-byte crafted TCP message.

AnalysisAI

Remote unauthenticated attackers can crash Eclipse OpenJ9 JITServer instances (versions 0.21-0.58) by sending a specially crafted 32-byte TCP message, triggering a buffer over-read (CWE-125) that causes denial of service. The vulnerability requires no authentication or user interaction, affecting any exposed JITServer endpoint. CVSS 8.7 (High) reflects the severe availability impact, though EPSS data is not available for this recent CVE. Exploit code is publicly available via GitHub PR #23793, which demonstrates the bounds-checking fix, though no active exploitation is confirmed at time of analysis.

Technical ContextAI

Eclipse OpenJ9 is an open-source JVM implementation featuring JITServer, a service that offloads Just-In-Time compilation to a remote server over TCP. The vulnerability (CWE-125: Out-of-bounds Read) exists in the MessageBuffer::readData() method within runtime/compiler/net/MessageBuffer.cpp. Prior to the fix, readData() advanced the buffer cursor (_curPtr) by dataSize bytes without validating that _curPtr + dataSize remained within buffer bounds (_storage + _capacity). An attacker sending a malformed 32-byte TCP message with an inflated dataSize value triggers a read beyond allocated memory, causing a crash. The patch adds bounds checking that throws a JITServer::StreamFailure exception when read operations would exceed buffer capacity, preventing the out-of-bounds access.

RemediationAI

Upgrade Eclipse OpenJ9 to version 0.59 or later, which includes the bounds-checking fix from pull request #23793 (https://github.com/eclipse-openj9/openj9/pull/23793). The patch modifies MessageBuffer::readData() to validate buffer boundaries before advancing the cursor, throwing StreamFailure exceptions on invalid read attempts. If immediate upgrade is not feasible, implement network-level access controls to restrict JITServer TCP port access to trusted compilation clients only - use firewall rules, VPN tunnels, or mTLS authentication to prevent unauthenticated network access. Note that access restrictions reduce attack surface but do not eliminate the vulnerability if a trusted client is compromised. Disabling JITServer entirely eliminates exposure with potential performance cost for distributed compilation workloads. Monitor JITServer logs for unexpected crashes or connection patterns from untrusted sources as temporary detective control.

Same weakness CWE-125 – Out-of-bounds Read

View all

CVE-2014-0160 HIGH POC

7.5

CVE-2016-5198 HIGH POC

8.8

CVE-2016-1646 HIGH POC

8.8

CVE-2025-5777 HIGH POC

7.5

CVE-2017-5030 HIGH POC

8.8

CVE-2016-4523 HIGH

7.5

CVE-2024-48456 HIGH POC

7.5

CVE-2024-48457 HIGH POC

7.5

Same technique Information Disclosure

View all

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

CVE-2023-7028 CRITICAL POC

10.0

CVE-2017-0213 HIGH POC

7.3

Vendor StatusVendor

SUSE

Severity: High

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed

CVE-2026-6918 vulnerability details – vuln.today

Back

Eclipse OpenJ9 CVE-2026-6918

Severity by source

CVSS VectorVendor: eclipse

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-125 – Out-of-bounds Read

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code