CVE-2026-111075: JITServer: Pre-authentication remote crash via integer underflow and out-of-bounds heap read in DataDescriptor deserialization
In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled size, paddingSize, and dataOffset fields during DataDescriptor message deserialization. An unauthenticated remote attacker can send a crafted network payload that triggers an unsigned integer underflow in DataDescriptor::getPayloadSize() and DataDescriptor::getNextDescriptor(). This results in an out-of-bounds heap read and an immediate process crash (SIGSEGV), causing a denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Eclipse OpenJ9 JITServerto a version that resolves this vulnerability.Fixed in 0.63.0
Event History
Frequently Asked Questions
Which deployments are exposed to remote exploitation?
Deployments using the JITServer component in Eclipse OpenJ9 versions prior to 0.63.0 are exposed. The vulnerable deserialization path accepts crafted network payloads before authentication.
What does an attacker need to exploit this issue?
An attacker needs network access to the JITServer service and the ability to send a crafted DataDescriptor message. No authentication is required.
What is the expected impact of successful exploitation?
Successful exploitation triggers an unsigned integer underflow followed by an out-of-bounds heap read, causing an immediate SIGSEGV process crash. The described impact is denial of service.
How can I determine whether my environment is affected?
Check whether JITServer is enabled or deployed and identify the Eclipse OpenJ9 version in use. Versions earlier than 0.63.0 are affected according to the available information.