Eclipse Openj9
Monthly
Remote unauthenticated attackers can crash Eclipse OpenJ9 JITServer instances (versions 0.21-0.58) by sending a specially crafted 32-byte TCP message, triggering a buffer over-read (CWE-125) that causes denial of service. The vulnerability requires no authentication or user interaction, affecting any exposed JITServer endpoint. CVSS 8.7 (High) reflects the severe availability impact, though EPSS data is not available for this recent CVE. Exploit code is publicly available via GitHub PR #23793, which demonstrates the bounds-checking fix, though no active exploitation is confirmed at time of analysis.
Eclipse OpenJ9 JVM versions through 0.60 crash with a segmentation fault when processing a crafted .class file containing deeply nested annotations, enabling a denial-of-service attack against any Java application running on OpenJ9 where an attacker can supply class files for loading. The vulnerability is rooted in uncontrolled recursion (CWE-674) within the bytecode utility annotation parser, which exhausts the OS thread stack without triggering a recoverable error path. No active exploitation has been confirmed by CISA KEV and no standalone exploit code has been publicly identified, though the public GitHub fix PR clearly exposes the triggering mechanism and root cause.
Remote unauthenticated attackers can crash Eclipse OpenJ9 JITServer instances (versions 0.21-0.58) by sending a specially crafted 32-byte TCP message, triggering a buffer over-read (CWE-125) that causes denial of service. The vulnerability requires no authentication or user interaction, affecting any exposed JITServer endpoint. CVSS 8.7 (High) reflects the severe availability impact, though EPSS data is not available for this recent CVE. Exploit code is publicly available via GitHub PR #23793, which demonstrates the bounds-checking fix, though no active exploitation is confirmed at time of analysis.
Eclipse OpenJ9 JVM versions through 0.60 crash with a segmentation fault when processing a crafted .class file containing deeply nested annotations, enabling a denial-of-service attack against any Java application running on OpenJ9 where an attacker can supply class files for loading. The vulnerability is rooted in uncontrolled recursion (CWE-674) within the bytecode utility annotation parser, which exhausts the OS thread stack without triggering a recoverable error path. No active exploitation has been confirmed by CISA KEV and no standalone exploit code has been publicly identified, though the public GitHub fix PR clearly exposes the triggering mechanism and root cause.