CVE-2026-97400
Received Received - Intake

Eclipse OpenJ9 Arbitrary File Read and Information Disclosure

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: Eclipse Foundation

Description
In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an arbitrary local file named inside the bundle and send its contents to an arbitrary remote host.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-97400
EUVD
EUVD-2026-105014

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Eclipse Foundation Eclipse OpenJ9 0.8.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-618 An ActiveX control is intended for use in a web browser, but it exposes dangerous methods that perform actions that are outside of the browser's security model (e.g. the zone or domain).
CWE-611 The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an XML External Entity (XXE) flaw in Eclipse OpenJ9 versions up to 0.63. When a user opens a malicious diagnostic dump bundle using the jdmpview tool or DTFJ code, the tool reads arbitrary local files named in the bundle and sends their contents to a remote attacker-controlled server. The root cause is an unsecured SAXParserFactory in XMLIndexReader.java that does not disable external entity processing.

Detection Guidance

To detect this vulnerability, monitor for suspicious network activity when using jdmpview or DTFJ tools. Check for unexpected outbound connections or file reads during XML processing. Review logs for commands like 'jdmpview -zip <bundle>' or '-core' options with XML files.

Impact Analysis

If you use Eclipse OpenJ9 or IBM Semeru Runtime with the vulnerable jdmpview tool or DTFJ module, opening a crafted diagnostic dump bundle could expose sensitive local files to an attacker. This includes files on your system that the tool has access to. The attacker could then retrieve these files remotely.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, such as personal or health information, violating GDPR and HIPAA compliance. Exposure of such data may result in legal penalties, reputational damage, and loss of trust due to non-compliance with data protection regulations.

Mitigation Strategies

Upgrade to a patched version of Eclipse OpenJ9 or IBM Semeru Runtime where the vulnerable code has been fixed. Disable external entity processing in XML parsing by configuring SAXParserFactory to disallow doctype declarations and external entities.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97400. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart