CVE-2026-110938: JITServer: Multiple Denial of Service vulnerabilities via out-of-bounds heap reads during message and reply parsing
In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper boundary checks during protocol message and reply handling. An unauthenticated remote attacker or malicious JITServer can transmit malformed network payloads that cause out-of-bounds heap reads, immediately crashing the JITServer daemon or client JVM process via a segmentation fault (SIGSEGV).
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Eclipse OpenJ9 deployments using the JITServer component are exposed in versions up to 0.63.0. Both the JITServer daemon and a client JVM process can be crashed.
What access does an attacker need to trigger the denial of service?
An unauthenticated remote attacker can send malformed network payloads during protocol message or reply handling. A malicious JITServer can also send malformed replies that crash a client JVM.
What is the observable impact of exploitation?
Malformed payloads can cause out-of-bounds heap reads and immediately terminate the affected JITServer daemon or client JVM with a SIGSEGV segmentation fault.