CVE-2026-111074
In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a…
- Risk score
- 64/100
- CVSS
- 8.7 v4.0
- Exploit chance (30 days)
- 0.4%
- Published
- 21 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remote denial of service. When processing the initial 4-byte length field of an incoming TCP connection, an integer overflow in MessageBuffer::computeRequiredCapacity() causes the receiving compilation worker thre…
- Affected
- See advisory
- Fix
- Upgrade the product to 0.63.0 or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 8.7 high
- Remotely exploitable without logging in
References
Original description
In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remote denial of service. When processing the initial 4-byte length field of an incoming TCP connection, an integer overflow in `MessageBuffer::computeRequiredCapacity()` causes the receiving compilation worker thread to enter an infinite loop consuming ~100% CPU. An unauthenticated remote attacker can exploit this by opening a small number of crafted TCP connections to exhaust the entire worker thread pool, silently halting compilation services for all connected client JVMs.
Last activity 21 Oct 2026. Patch Forecast updates every hour.