Live › vulnerability › CVE-2026-110938
Go to dashboardEclipse OpenJ9 up to 0.63.0 has missing bounds checks in the JITServer protocol, so malformed network messages trigger out-of-bounds heap reads. An unauthenticated remote attacker or a malicious JITServer can crash the JITServer daemon or the client JVM with a segfault.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check whether JITServer is in use: look for -XX:+JITServerTechPreview or -XX:+UseJITServer in JVM startup flags, and check the OpenJ9 version with java -version.
0.63.0; the fixed version is unknown from the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper boundary checks during protocol message and reply handling. An unauthenticated remote attacker or malicious JITServer can transmit malformed network payloads that cause out-of-bounds heap reads, immediately crashing the JITServer daemon or client JVM process via a segmentation fault (SIGSEGV).
This page as .md · .json · in your agent: get_signal("CVE-2026-110938")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.