CVE-2026-110938

Awaiting Analysis Awaiting Analysis - Queue

Denial of Service in Eclipse OpenJ9 JITServer

Publication date: 2026-10-21

Last updated on: 2026-10-26

Assigner: Eclipse Foundation

Description

In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper boundary checks during protocol message and reply handling. An unauthenticated remote attacker or malicious JITServer can transmit malformed network payloads that cause out-of-bounds heap reads, immediately crashing the JITServer daemon or client JVM process via a segmentation fault (SIGSEGV).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-26

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-09

NVD

CVE-2026-110938

EUVD

EUVD-2026-107139

Affected Vendors & Products

Vendor	Product	Version / Range
Eclipse Foundation	Eclipse OpenJ9	0.8.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

CVE-2026-110938 affects Eclipse OpenJ9 versions up to 0.63.0, specifically the JITServer component. It allows unauthenticated remote attackers or malicious JITServers to crash the JITServer or client JVM processes via malformed network payloads. The issue stems from improper boundary checks during protocol message handling, causing out-of-bounds heap reads that lead to segmentation faults (SIGSEGV).

The vulnerability occurs when attackers send crafted messages with excessively large vector sizes (e.g., 6,200,000 elements) in nested tuples or vectors, triggering unbounded loops or memory reads in functions like RawTypeConvert<std::vector<T>>::onRecv().

Detection Guidance

Monitor for crashes in JITServer or client JVM processes, especially after receiving network traffic on port 38402. Check logs for segmentation faults (SIGSEGV) in OpenJ9 versions up to 0.63.0. Use network monitoring tools to inspect malformed payloads targeting JITServer protocol messages.

Impact Analysis

This vulnerability can disrupt services by crashing the JITServer or client JVM processes, leading to denial-of-service conditions. Affected systems may experience interrupted compilation services for all connected clients, requiring manual restart of the JITServer or JVMs.

For systems using Eclipse OpenJ9 with JITServer enabled, an attacker could remotely trigger crashes without authentication or user interaction, causing immediate service disruption.

Compliance Impact

This vulnerability primarily causes denial-of-service (DoS) conditions by crashing JITServer or client JVM processes via segmentation faults. It does not directly impact data confidentiality or integrity, which are key focus areas for GDPR and HIPAA. However, prolonged DoS conditions could disrupt availability of services processing personal or health data, potentially violating availability requirements in these regulations.

Mitigation Strategies

Upgrade to a patched OpenJ9 version with bounds checking for vector sizes in protocol messages. Block or restrict access to JITServer port 38402 from untrusted networks. Monitor for suspicious network activity targeting this port.

Hi! I’m here to help you understand CVE-2026-110938. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...