CVE-2026-111074

Awaiting Analysis Awaiting Analysis - Queue

Eclipse OpenJ9 JITServer Pre-Authentication DoS via Integer Overflow

Publication date: 2026-10-21

Last updated on: 2026-10-26

Assigner: Eclipse Foundation

Description

In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remote denial of service. When processing the initial 4-byte length field of an incoming TCP connection, an integer overflow in `MessageBuffer::computeRequiredCapacity()` causes the receiving compilation worker thread to enter an infinite loop consuming ~100% CPU. An unauthenticated remote attacker can exploit this by opening a small number of crafted TCP connections to exhaust the entire worker thread pool, silently halting compilation services for all connected client JVMs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-26

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-09

NVD

CVE-2026-111074

EUVD

EUVD-2026-107134

Affected Vendors & Products

Vendor	Product	Version / Range
Eclipse Foundation	Eclipse OpenJ9	0.8.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
CWE-835	The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

Executive Summary

This is a pre-authentication remote denial of service (DoS) vulnerability in Eclipse OpenJ9's JITServer component. It occurs due to an integer overflow in the MessageBuffer::computeRequiredCapacity() function when processing a 4-byte length field from a TCP connection. If the value is between 0x80000000 and 0xFFFFFFFF, it causes an infinite loop in the buffer-growth routine, consuming 100% CPU and exhausting the worker thread pool.

Detection Guidance

Monitor for high CPU usage on JITServer compilation worker threads. Check for TCP connections with malformed 4-byte length fields (values in range 0x80000000 to 0xFFFFFFFF). Use tools like netstat or ss to inspect active connections to JITServer ports (default 38400).

Commands: netstat -tulnp | grep 38400, ss -tulnp | grep 38400, top -H -p $(pgrep -f JITServer). Look for threads consuming 100% CPU with names like 'compilation-worker'.

Impact Analysis

An unauthenticated remote attacker can exploit this by opening a few crafted TCP connections to crash the JITServer. This halts compilation services for all connected client JVMs, causing silent DoS and potentially disrupting applications relying on JIT compilation for performance.

Compliance Impact

This vulnerability causes a pre-authentication remote denial of service (DoS) by exhausting JITServer compilation worker threads, leading to service unavailability for all connected client JVMs. For compliance standards like GDPR and HIPAA, which require availability of critical systems processing personal or health data, such a DoS could result in prolonged downtime, potential data processing interruptions, and failure to meet service level agreements. Regulatory frameworks often mandate protections against DoS attacks to ensure system resilience and data accessibility.

Mitigation Strategies

Upgrade OpenJ9 to version 0.63.0 or later. Apply the patch from pull request #25008 which limits message sizes to 1 GB. Restart JITServer services after applying updates.

If immediate upgrade is not possible, restrict network access to JITServer ports using firewalls. Monitor for signs of exploitation and terminate suspicious TCP connections.

Hi! I’m here to help you understand CVE-2026-111074. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...