{"id":"CVE-2026-110938","kind":"vulnerability","aliases":["CVE-2026-110938"],"related":[],"title":"Eclipse OpenJ9 JITServer: malformed network messages crash the JVM","description":"In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper boundary checks during protocol message and reply handling. An unauthenticated remote attacker or malicious JITServer can transmit malformed network payloads that cause out-of-bounds heap reads, immediately crashing the JITServer daemon or client JVM process via a segmentation fault (SIGSEGV).","summary":"Eclipse OpenJ9 up to 0.63.0 has missing bounds checks in the JITServer protocol, so malformed network messages trigger out-of-bounds heap reads. An unauthenticated remote attacker or a malicious JITServer can crash the JITServer daemon or the client JVM with a segfault.","severity":"high","cvss":8.7,"epss":0.00415,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","jitserver","openj9","runtime","self-hosted"],"not_affected_if":["default-config","no-jitserver"],"how_to_check":"Check whether JITServer is in use: look for -XX:+JITServerTechPreview or -XX:+UseJITServer in JVM startup flags, and check the OpenJ9 version with java -version.","fix":"Upgrade OpenJ9 to a release newer than 0.63.0; the fixed version is unknown from the sources.\nDisable JITServer or restrict its port to trusted hosts until patched.","status":"open","published_at":"2026-10-21T09:17:06+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-23T22:36:54+00:00","updated_at":"2026-10-24T13:15:54+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-23T22:36:54Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade OpenJ9 to a release newer than 0.63.0; the fixed version is unknown from the sources.\nDisable JITServer or restrict its port to trusted hosts until patched.","reach":"network","title":"Eclipse OpenJ9 JITServer: malformed network messages crash the JVM","impact":"medium","summary":"Eclipse OpenJ9 up to 0.63.0 has missing bounds checks in the JITServer protocol, so malformed network messages trigger out-of-bounds heap reads. An unauthenticated remote attacker or a malicious JITServer can crash the JITServer daemon or the client JVM with a segfault.","category":"runtime","who_cares":["openj9","java","jitserver","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Remote crash of JITServer daemon or client JVM via segfault.","analyst_note":"Confirm the fixed OpenJ9 version and the JITServer flag names at the NVD entry or Eclipse advisory; sources do not give them.","how_to_check":"Check whether JITServer is in use: look for -XX:+JITServerTechPreview or -XX:+UseJITServer in JVM startup flags, and check the OpenJ9 version with java -version.","needs_analyst":true,"not_affected_if":["default-config","no-jitserver"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000548,"input_tokens":2963,"output_tokens":504,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-110938':12A,15A '-2026':11A,14A '0.63.0':27B,73C 'attack':50B,97C 'bound':30B,44B,111C 'boundari':86C 'caus':107C 'check':31B,87C 'client':62B,120C 'compon':76C 'crash':7A,56B,115C 'cve':10A,13A 'daemon':59B,118C 'denial':80C 'due':83C 'eclips':1A,23B,68C 'fault':126C 'handl':93C 'heap':45B,112C 'host':22B 'immedi':114C 'improp':85C 'java':16B 'jitserv':3A,17B,34B,54B,58B,75C,100C,117C 'jvm':9A,63B,121C 'malform':4A,37B,103C 'malici':53B,99C 'messag':6A,39B,90C 'miss':29B 'network':5A,38B,104C 'openj9':2A,18B,24B,69C 'out-of-bound':41B,108C 'payload':105C 'process':122C 'protocol':35B,89C 'read':46B,113C 'remot':49B,96C 'repli':92C 'runtim':19B 'segfault':66B 'segment':125C 'self':21B 'self-host':20B 'servic':82C 'sigsegv':127C 'transmit':102C 'trigger':40B 'unauthent':48B,95C 'version':70C 'via':123C 'vulner':78C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T09:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110938","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110938","severity":null,"published_at":"2026-10-21T09:17:06+00:00","modified_at":"2026-10-22T17:21:57+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-110938","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110938","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}