CVE-2026-111074: JITServer: Pre-authentication remote Denial of Service via integer overflow infinite loop in MessageBuffer::computeRequiredCapacity()
In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remote denial of service. When processing the initial 4-byte length field of an incoming TCP connection, an integer overflow in MessageBuffer::computeRequiredCapacity() causes the receiving compilation worker thread to enter an infinite loop consuming ~100% CPU. An unauthenticated remote attacker can exploit this by opening a small number of crafted TCP connections to exhaust the entire worker thread pool, silently halting compilation services for all connected client JVMs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Eclipse OpenJ9 JITServerto a version that resolves this vulnerability.Fixed in 0.63.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using the Eclipse OpenJ9 JITServer component are exposed if they run a version earlier than 0.63.0 and accept incoming TCP connections to JITServer. The issue affects compilation services for all client JVMs connected to the exhausted server.
What does an attacker need to exploit the vulnerability?
An attacker does not need to authenticate. They need network access to open TCP connections to JITServer and send crafted initial 4-byte length fields; only a small number of connections may exhaust the compilation worker pool.
How can I determine whether my environment is affected?
Check whether JITServer is deployed and identify the Eclipse OpenJ9 version in use. Versions prior to 0.63.0 are affected; a successful attack can appear as JITServer compilation worker threads consuming approximately 100% CPU while compilation services stop responding for connected clients.