Eclipse Foundation Eclipse OpenJ9
7 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-110938 | 0.8.0 – < 0.63 | JITServer: Multiple Denial of Service vulnerabilities via out-of-bounds heap reads during message and reply parsing | HIGH 8.7 | 0.4 % | ||
| CVE-2026-111075 | 0.8.0 – < 0.63 | JITServer: Pre-authentication remote crash via integer underflow and out-of-bounds heap read in DataDescriptor deserialization | HIGH 8.7 | 0.4 % | ||
| CVE-2026-111074 | 0.8.0 – < 0.63 | JITServer: Pre-authentication remote Denial of Service via integer overflow infinite loop in MessageBuffer::computeRequiredCapacity() | HIGH 8.7 | 0.4 % | ||
| CVE-2026-97400 | 0.8.0 – < 0.63 | jdmpview / DTFJ reads arbitrary local files and makes arbitrary outbound requests when opening a third-party diagnostic dump bundle (XXE … | MEDIUM 6.8 | 0.2 % | ||
| CVE-2026-16440 | 0.8.0 – < 0.60 | In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a segmentation fault. | MEDIUM 5.7 | 0.3 % | ||
| CVE-2026-6918 | 0.21 – < 0.59 | In Eclipse Open9J versions 0.21 to 0.58, a pre-authentication remote attacker can crash JITServer by sending a 32-byte crafted TCP message. | HIGH 8.7 | 0.5 % | ||
| CVE-2023-2597 | unspecified – 0.37.0 | In Eclipse Openj9 before version 0.38.0, in the implementation of the shared cache (which is enabled by default in OpenJ9 builds) the size o | CRITICAL 9.1 | 0.4 % |