High severity · published Oct 21, 2026
CVE-2026-110938
JITServer: Multiple Denial of Service vulnerabilities via out-of-bounds heap reads during message and reply parsing
8.7
CVSS
0.4%
EPSS
No
On KEV
Description
In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper boundary checks during protocol message and reply handling. An unauthenticated remote attacker or malicious JITServer can transmit malformed network payloads that cause out-of-bounds heap reads, immediately crashing the JITServer daemon or client JVM process via a segmentation fault (SIGSEGV).
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EO
Eclipse OpenJ9 · Eclipse Foundation
0.8.0 before 0.63 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-110938
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-110938
github.com
https://github.com/eclipse-openj9/openj9/pull/25011
gitlab.eclipse.org
https://gitlab.eclipse.org/security/cve-assignment/-/work_items/407
gitlab.eclipse.org
https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/943
gitlab.eclipse.org
https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/944
gitlab.eclipse.org
https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/946
gitlab.eclipse.org
https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/947
More from Eclipse OpenJ9
8.7
CVE-2026-111075
JITServer: Pre-authentication remote crash via integer underflow and out-of-bounds heap read in DataDescriptor deserialization
8.7
CVE-2026-111074
JITServer: Pre-authentication remote Denial of Service via integer overflow infinite loop in MessageBuffer::computeRequiredCapacity()
7.5
CVE-2026-6918
In Eclipse Open9J versions 0.21 to 0.58, a pre-authentication remote attacker can crash JITServer by sending a 32-byte crafted TCP message
6.8
CVE-2026-97400
jdmpview / DTFJ reads arbitrary local files and makes arbitrary outbound requests when opening a third-party diagnostic dump bundle (XXE in XMLIndexReader)
5.7
CVE-2026-16440
In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a segmentation fault