Live › vulnerability › CVE-2026-111074
Go to dashboardEclipse OpenJ9 before 0.63.0 has an integer overflow in the JITServer length-field handling, so an unauthenticated remote client can send a few crafted TCP connections. The compilation worker threads then spin at about 100% CPU, stopping compilation for every connected client JVM.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check whether JITServer mode is in use: look for -XX:+JITServer or -XX:JITServerAddress flags in JVM startup options, and check the OpenJ9 version with java -version.
0.63.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remote denial of service. When processing the initial 4-byte length field of an incoming TCP connection, an integer overflow in MessageBuffer::computeRequiredCapacity() causes the receiving compilation worker thread to enter an infinite loop consuming ~100% CPU. An unauthenticated remote attacker can exploit this by opening a small number of crafted TCP connections to exhaust the entire worker thread pool, silently halting compilation services for all connected client JVMs.
This page as .md · .json · in your agent: get_signal("CVE-2026-111074")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.