Eclipse Openj9 (Eclipse Foundation) - vulnerabilities (CVEs)

7 CVEs, 4 in the last 30 days, 2 known versions, newest CVE from 2026-10-21. Vendor: Eclipse Foundation.

CVEs of Eclipse Openj9

• CVE-2026-110938 - CVSS 8.7 (high), 2026-10-21: In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper boundary checks during protocol message…
• CVE-2026-111075 - CVSS 8.7 (high), 2026-10-21: In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled `_size`, `_paddingSize`,…
• CVE-2026-111074 - CVSS 8.7 (high), 2026-10-21: In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remote denial of service. When processing the…
• CVE-2026-97400 - CVSS 6.8 (medium), 2026-10-20: In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's…
• CVE-2026-16440 - CVSS 5.7 (medium), 2026-08-19: In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a segmentation fault.
• CVE-2026-6918 - CVSS 8.7 (high), 2026-05-05: In Eclipse Open9J versions 0.21 to 0.58, a pre-authentication remote attacker can crash JITServer by sending a 32-byte crafted TCP message.
• CVE-2023-2597 - CVSS 9.1 (critical), 2023-05-22: In Eclipse Openj9 before version 0.38.0, in the implementation of the shared cache (which is enabled by default in OpenJ9 builds) the size of a string is not…