Vulnerability · Published Oct 21, 2026 · Assigned by eclipse

CVE-2026-110938JITServer: Multiple Denial of Service vulnerabilities via out-of-bounds heap reads during message and reply parsing

High 8.7

In plain English

A high-severity out-of-bounds read in Eclipse OpenJ9 from Eclipse Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.4%top 64.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper boundary checks during protocol message and reply handling. An unauthenticated remote attacker or malicious JITServer can transmit malformed network payloads that cause out-of-bounds heap reads, immediately crashing the JITServer daemon or client JVM process via a segmentation fault (SIGSEGV).

Affected products (as reported)

Vendor	Product	Versions
Eclipse Foundation	Eclipse OpenJ9	0.8.0 – before 0.63

Weakness: CWE-125, CWE-20 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

In plain English

Official description

Affected products (as reported)

References