EUVD-2026-107139
GHSA-vj95-43qj-j5mf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed JITServer endpoint
-
ExploitSend malformed protocol message or reply
-
ExecutionTrigger out-of-bounds heap read
-
ImpactCrash JITServer daemon or client JVM (SIGSEGV)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the optional OpenJ9 JITServer mode to be deployed and the JITServer daemon (or the client JVM's connection to it) to be network-reachable by the attacker; JITServer is not enabled in default JVM operation, so standard OpenJ9 installations are not exposed. When JITServer IS enabled, no authentication or user interaction is needed (PR:N/UI:N): an unauthenticated remote attacker can crash the daemon, or a malicious/compromised JITServer can crash connecting client JVMs, by sending malformed protocol payloads (oversized message size, out-of-range message type, or descriptors whose offset/payload/element sizes exceed message bounds). Affected versions are OpenJ9 up to 0.63.0. The primary limiting factor is the non-default JITServer deployment requirement and network reachability of the JITServer channel. |
| Impact | The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) scores 8.7 (High) and credibly reflects an unauthenticated, low-complexity, remote availability-only impact - there is NO confidentiality or integrity impact (VC:N/VI:N), so despite being a CWE-125 out-of-bounds heap read, the realized outcome is a crash (SIGSEGV), not data theft or code execution. No EPSS score, no CISA KEV entry, and no public POC are present in the provided data, so exploitation status is: no public exploit identified at time of analysis. The high base score is driven almost entirely by VA:H combined with the unauthenticated network vector; this is a classic 'high-CVSS DoS' rather than a wormable or high-value target. Crucially, exploitation is gated on the optional JITServer mode being enabled and network-reachable, which sharply narrows the real-world exploitable population below what the raw score implies. Conflicting signal to note: the input Tags list 'Information Disclosure', but the CVSS vector and description (crash via SIGSEGV) indicate availability-only impact - treat the info-disclosure characterization as unverified. Net: a genuine priority for the specific subset of deployments running JITServer (cloud/container JVM compilation farms), but low priority for the large majority of OpenJ9 installations that never enable it. |
| Exploit ScenarioDerived | An attacker able to reach an exposed JITServer daemon port sends a crafted protocol message with a malformed size, message type, or data descriptor, causing an out-of-bounds heap read that immediately crashes the daemon with a segmentation fault; symmetrically, a malicious or compromised JITServer can send malformed replies that crash connecting client JVMs. Given AV:N/AC:L/PR:N, no authentication or user interaction is required once the JITServer channel is reachable, though no public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Denial of service in Eclipse OpenJ9 through 0.63.0 affects deployments that enable the optional JITServer mode, where unauthenticated remote attackers or a malicious JITServer peer can crash the daemon or a client JVM with malformed protocol messages. The vendor CVSS 4.0 score is 8.7 (High), and the assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms remote, low-complexity, availability-only impact with no confidentiality or integrity loss. JITServer is not enabled in default JVM operation, so standard OpenJ9 installations are not exposed; no public exploit or CISA KEV entry was identified at time of analysis.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed. Apply the boundary-check fixes from eclipse-openj9/openj9 PR 25011 at https://github.com/eclipse-openj9/openj9/pull/25011 or upgrade to a vendor OpenJ9 release that incorporates that fix, and confirm the patched release level with the vendor because no exact fixed version is specified in the provided data. If JITServer is not required, disable the optional JITServer mode by not running the JITServer daemon and not configuring client JVMs to use it; the trade-off is loss of remote JIT compilation benefits. If JITServer must remain in use, restrict network reachability of the JITServer channel to trusted client JVMs and the daemon using firewall rules or network segmentation, accepting that this can break legitimate distributed JITServer topologies and adds operational complexity. Monitor JITServer and JVM logs for StreamFailure indications or SIGSEGV crashes, and consult the Eclipse GitLab work items 943, 944, 946, and 947 plus CVE assignment 407 for vendor guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Eclipse OpenJ9's JITServer is an optional remote compilation service in which a client JVM sends compilation requests to a JITServer daemon over a network protocol. The vulnerability is rooted in improper boundary checks while handling protocol messages and replies, corresponding to CWE-125 out-of-bounds heap read. Untrusted wire fields such as the advertised serialized message size, message type used as an array index, metadata data-point count, descriptor offsets, descriptor payload size, and vector element size were not sufficiently validated before use. Crafted payloads can therefore cause out-of-bounds reads that terminate the JITServer daemon or client JVM with SIGSEGV. The upstream PR adds defensive checks including a 1 GB message-size cap, message-type range validation, minimum metadata size enforcement, a 256-parameter limit, descriptor validation for padding/data-offset/size consistency, payload-size checks against the expected type, and vector element-size validation. The CPE cpe:2.3:a:eclipse_foundation:eclipse_openj9:*:*:*:*:*:*:*:* reflects the broad OpenJ9 package range, but exposure is limited to deployments where JITServer is enabled and network-reachable.
Know when Eclipse Openj9 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Unauthenticated network-reachable JITServer with no auth (PR:N) and trivial crafted payloads (AC:L); impact is availability-only crash (A:H, C:N/I:N), same component so S:U.
Primary rating from Vendor (eclipse).
CVSS VectorVendor: eclipse
Lifecycle Timeline
2DescriptionCVE.org
In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper boundary checks during protocol message and reply handling. An unauthenticated remote attacker or malicious JITServer can transmit malformed network payloads that cause out-of-bounds heap reads, immediately crashing the JITServer daemon or client JVM process via a segmentation fault (SIGSEGV).
Executive ViewAI
A high-severity denial-of-service vulnerability in Eclipse OpenJ9 (through version 0.63.0) can crash JVMs or the JITServer daemon, but only in deployments that explicitly enable the optional JITServer mode. Because default OpenJ9 configurations are not exposed and the impact is limited to availability with no data confidentiality or integrity loss, leadership should focus on identifying and protecting the small subset of teams using JITServer rather than initiating an organization-wide emergency response.
No vendor-released patch identified at time of analysis. Interim mitigations: disable JITServer mode where not required; restrict JITServer network listeners to trusted peers using firewall rules or network segmentation; remove any internet-facing JITServer endpoints; monitor JVM and daemon logs for crash events or malformed protocol messages; limit JITServer client connections to authorized hosts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Eclipse Openj9
View allRemote denial of service in Eclipse OpenJ9 JITServer before 0.63.0 lets unauthenticated network attackers exhaust compil
Denial of service in Eclipse OpenJ9's optional JITServer component (versions prior to 0.63.0) allows an unauthenticated
Remote unauthenticated attackers can crash Eclipse OpenJ9 JITServer instances (versions 0.21-0.58) by sending a speciall
Eclipse OpenJ9 through 0.63 can expose local files to a remote receiver when an analyst opens a crafted diagnostic dump
Eclipse OpenJ9 JVM versions through 0.60 crash with a segmentation fault when processing a crafted .class file containin
Exploit-DB