Vulnerability feed
CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run
| Expand | Severity |
Score |
Advisory |
Title |
Source |
Flags |
Published |
|---|---|---|---|---|---|---|---|
| High | 8.7 | CVE-2026-110938 |
In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper boundary checks during protocol message and reply handling
Eclipse Foundation, EclipseEclipse Foundation Eclipse OpenJ9, Eclipse OpenJ9
|
NVD | |||
|
CVE-2026-110938In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper boundary checks during protocol message and reply handling
Executive summaryEclipse OpenJ9 versions up to 0.63.0 have a flaw in the JITServer component that can allow a denial of service. The advisory does not state a severity score, and it does not say whether the vendor has released a fixed version beyond the code changes described in the linked pull requests. Technical summaryThe flaw is an improper boundary check on protocol messages and reply handling in the JITServer component of Eclipse OpenJ9 up to 0.63.0. A malicious client can send crafted messages with data descriptors whose size, padding, and data offset values misrepresent the payload, causing the server to read past the allocated message buffer or loop infinitely on very large messages. The described fixes add descriptor validation, a 1 GB message size limit, a 256 parameter limit, and a StreamFailure exception on out-of-bounds reads. The advisory does not state a CVSS score, affected version ranges beyond 'up to 0.63.0', a fixed version number, a workaround, or detection guidance. Exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/eclipse-openj9/openj9/pull/25011 Impact if exploitedConfidentialityNone IntegrityNone AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X AffectsEclipse FoundationEclipseEclipse Foundation Eclipse OpenJ9Eclipse OpenJ9
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 8.7 | CVE-2026-111075 |
In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled `_size`, `_paddingSize`, and `_dataOffset`...
Eclipse Foundation, EclipseEclipse Foundation Eclipse OpenJ9, Eclipse OpenJ9, Eclipse JITServer
|
NVD | |||
|
CVE-2026-111075In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled `_size`, `_paddingSize`, and `_dataOffset`...
Executive summaryThe advisory says Eclipse OpenJ9 versions prior to 0.63.0 are affected by a flaw in the JITServer component that lets an attacker-controlled message descriptor cause the server to read out-of-bounds data. The advisory text provided does not state a severity rating, and it does not state a fixed version beyond the 0.63.0 threshold named in the description. Technical summaryThe flaw is a missing cross-field validation of attacker-controlled _size, _paddingSize, and _dataOffset values in a JITServer message data descriptor, which can make getPayloadSize() return a very large value and cause out-of-bounds reads. The advisory describes a malicious client as the attacker and implies a network-reachable JITServer connection, but a specific attack vector and authentication requirements are not stated. Affected versions are stated as prior to 0.63.0. The commit notes describe fixes that add DataDescriptor::validate(), limit _paddingSize to less than 4, limit _dataOffset to 0 or 4, require _size to be at least _paddingSize plus _dataOffset, cap messages at 256 parameters, and refuse messages larger than 1 GB, but the advisory does not state a workaround, a CVSS score, exploitation status, or detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/eclipse-openj9/openj9/pull/25009 Impact if exploitedConfidentialityNone IntegrityNone AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X AffectsEclipse FoundationEclipseEclipse Foundation Eclipse OpenJ9Eclipse OpenJ9Eclipse JITServer
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 8.7 | CVE-2026-111074 |
In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remote denial of service
Eclipse Foundation, EclipseEclipse Foundation Eclipse OpenJ9, Eclipse OpenJ9
|
NVD | |||
|
CVE-2026-111074In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remote denial of service
Executive summaryThe advisory says Eclipse OpenJ9 versions prior to 0.63.0 have a flaw in the JITServer component that allows a remote attacker to cause a denial of service without authenticating. The text includes a developer discussion of a fix that makes the server refuse messages larger than 1 GB. The advisory does not state a severity score, so the seriousness beyond denial of service is not stated. Technical summaryThe advisory describes a pre-authentication remote denial of service in the JITServer component of Eclipse OpenJ9 prior to 0.63.0. The embedded developer text says oversized messages could cause the server to allocate excessive memory and could trigger an infinite loop in MessageBuffer::computeRequiredCapacity() when message size exceeds 2 GB. The fix described is to refuse any message larger than 1 GB, referenced by commit 3ab6df2. The advisory does not state a CVSS score, an exploitation status, or a specific fixed version number beyond the 0.63.0 threshold, and it does not state workarounds or detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: Eclipse OpenJ9 JITServer Summarized from github.com/eclipse-openj9/openj9/pull/25008 Impact if exploitedConfidentialityNone IntegrityNone AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X AffectsEclipse FoundationEclipseEclipse Foundation Eclipse OpenJ9Eclipse OpenJ9
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 6.8 | CVE-2026-97400 |
In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an...
Eclipse FoundationEclipse Foundation Eclipse OpenJ9
|
NVD | |||
|
CVE-2026-97400In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an...
From the advisoryIn Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an arbitrary local file named inside the bundle and send its contents to an arbitrary remote host. Impact if exploitedConfidentialityHigh IntegrityLow AvailabilityLow
How it is exploited
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||