Denial of Service Vulnerability in Eclipse OpenJ9 JITServer Component

CVE-2026-110938

What is CVE-2026-110938?

In versions up to 0.63.0 of Eclipse OpenJ9, the JITServer component is susceptible to a denial of service attack stemming from improper boundary checks in protocol message handling. An unauthenticated remote attacker may exploit this vulnerability by sending specially crafted network payloads, triggering out-of-bounds heap reads. This can result in an immediate crash of the JITServer daemon or the client JVM process due to a segmentation fault (SIGSEGV). Organizations using affected versions should prioritize updating to avoid potential disruptions.

References