Denial of Service Vulnerability in Eclipse OpenJ9 JITServer Component

CVE-2026-111074

What is CVE-2026-111074?

Eclipse OpenJ9 versions prior to 0.63.0 feature a vulnerability in the JITServer component that can lead to a denial of service through an integer overflow in the processing of the TCP connection's initial length field. An unauthenticated remote attacker can exploit this vulnerability by establishing a limited number of specially crafted TCP connections, causing the compilation worker thread to enter an infinite loop. This exploitation results in a significant increase in CPU consumption, ultimately exhausting all available worker threads and halting compilation services for connected client JVMs.

References