In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper boundary checks during protocol message and reply handling. An unauthenticated remote attacker or malicious JITServer can transmit malformed network payloads that cause out-of-bounds heap reads, immediately crashing the JITServer daemon or client JVM process via a segmentation fault (SIGSEGV).
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 21 Oct 2026 08:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper boundary checks during protocol message and reply handling. An unauthenticated remote attacker or malicious JITServer can transmit malformed network payloads that cause out-of-bounds heap reads, immediately crashing the JITServer daemon or client JVM process via a segmentation fault (SIGSEGV). | |
| Title | JITServer: Multiple Denial of Service vulnerabilities via out-of-bounds heap reads during message and reply parsing | |
| Weaknesses | CWE-125 CWE-20 |
|
| References |
|
|
| Metrics |
cvssV4_0
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: eclipse
Published:
Updated: 2026-10-21T08:03:26.062Z
Reserved: 2026-10-15T07:11:06.825Z
Link: CVE-2026-110938
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-21T09:17:06.717
Modified: 2026-10-21T09:17:06.717
Link: CVE-2026-110938
Redhat
No data.
OpenCVE Enrichment
No data.