Medium severity · published Oct 20, 2026
CVE-2026-97400
jdmpview / DTFJ reads arbitrary local files and makes arbitrary outbound requests when opening a third-party diagnostic dump bundle (XXE in XMLIndexReader)
6.8
CVSS
0.2%
EPSS
No
On KEV
Description
In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an arbitrary local file named inside the bundle and send its contents to an arbitrary remote host.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EO
Eclipse OpenJ9 · Eclipse Foundation
0.8.0 before 0.63 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-97400
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-97400
github.com
https://github.com/eclipse-openj9/openj9/pull/25003
gitlab.eclipse.org
https://gitlab.eclipse.org/security/cve-assignment/-/work_items/324
gitlab.eclipse.org
https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/949
More from Eclipse OpenJ9
8.7
CVE-2026-110938
JITServer: Multiple Denial of Service vulnerabilities via out-of-bounds heap reads during message and reply parsing
8.7
CVE-2026-111075
JITServer: Pre-authentication remote crash via integer underflow and out-of-bounds heap read in DataDescriptor deserialization
8.7
CVE-2026-111074
JITServer: Pre-authentication remote Denial of Service via integer overflow infinite loop in MessageBuffer::computeRequiredCapacity()
7.5
CVE-2026-6918
In Eclipse Open9J versions 0.21 to 0.58, a pre-authentication remote attacker can crash JITServer by sending a 32-byte crafted TCP message
5.7
CVE-2026-16440
In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a segmentation fault