Denial of Service Vulnerability in Eclipse OpenJ9 JITServer Component
CVE-2026-111075

8.7HIGH

Key Information:

Vendor

Eclipse Foundation

Status
Eclipse Openj9
Vendor
CVE Published:
21 October 2026

What is CVE-2026-111075?

In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component exhibits a vulnerability due to insufficient cross-field validation when deserializing DataDescriptor messages. Attackers can exploit this by sending a specially crafted network payload, which leads to an unsigned integer underflow within the functions DataDescriptor::getPayloadSize() and DataDescriptor::getNextDescriptor(). This exploitation triggers an out-of-bounds heap read, resulting in a process crash (SIGSEGV) and causing a denial of service. This vulnerability underscores the importance of strict validation in network protocols to prevent adverse impacts on service availability.

Affected Version(s)

Eclipse OpenJ9 0.8.0 < 0.63

References

https://github.com/eclipse-openj9/openj9/pull/25009
https://gitlab.eclipse.org/security/vulnerability-reports...
https://gitlab.eclipse.org/security/cve-assignment/-/work...

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Duc Anh Nguyen (VinSOC) — `@gladiator9797` — mra9797@gmail.com
.