CVE-2026-16440
Received Received - Intake

Segmentation Fault in Eclipse OpenJ9 Due to Deeply Nested Annotations

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Eclipse Foundation

Description
In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a segmentation fault.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-16440
EUVD
EUVD-2026-62368

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
eclipse openj9 to 0.60 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-16440 is a vulnerability in Eclipse OpenJ9 versions up to 0.60 where a specially crafted .class file with deeply nested annotations triggers a segmentation fault. This occurs due to recursive operations in class file parsing that lead to stack overflow when processing malicious input.

Detection Guidance

Detecting this vulnerability requires checking for Eclipse OpenJ9 versions up to 0.60. Use commands like 'java -version' to identify the OpenJ9 version. If the version is 0.60 or earlier, the system is vulnerable.

Impact Analysis

This vulnerability could cause a Java Virtual Machine (JVM) crash when processing a maliciously crafted class file, leading to denial of service. Systems running vulnerable versions of Eclipse OpenJ9 may become unresponsive or terminate unexpectedly upon encountering such files.

Mitigation Strategies

Update Eclipse OpenJ9 to a version that includes the security fix. Apply the patch from the pull request at https://github.com/eclipse-openj9/openj9/pull/24572. Ensure all systems using OpenJ9 are upgraded to prevent stack overflow attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16440. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart