---
id: "CVE-2026-110938"
kind: "vulnerability"
aliases: ["CVE-2026-110938"]
title: "Eclipse OpenJ9 JITServer: malformed network messages crash the JVM"
severity: "high"
cvss: 8.7
epss: 0.00415
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["java", "jitserver", "openj9", "runtime", "self-hosted"]
not_affected_if: ["default-config", "no-jitserver"]
published_at: "2026-10-21T09:17:06+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-24T13:15:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110938", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-110938", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Eclipse OpenJ9 JITServer: malformed network messages crash the JVM

Eclipse OpenJ9 up to 0.63.0 has missing bounds checks in the JITServer protocol, so malformed network messages trigger out-of-bounds heap reads. An unauthenticated remote attacker or a malicious JITServer can crash the JITServer daemon or the client JVM with a segfault.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check whether JITServer is in use: look for -XX:+JITServerTechPreview or -XX:+UseJITServer in JVM startup flags, and check the OpenJ9 version with java -version.

## Fix

Upgrade OpenJ9 to a release newer than 0.63.0; the fixed version is unknown from the sources.
Disable JITServer or restrict its port to trusted hosts until patched.

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110938
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-110938

## From the sources

In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper boundary checks during protocol message and reply handling. An unauthenticated remote attacker or malicious JITServer can transmit malformed network payloads that cause out-of-bounds heap reads, immediately crashing the JITServer daemon or client JVM process via a segmentation fault (SIGSEGV).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_