{"id":"CVE-2026-111075","kind":"vulnerability","aliases":["CVE-2026-111075"],"related":[],"title":"Eclipse OpenJ9: crafted JITServer message crashes the JVM via heap read","description":"In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled `_size`, `_paddingSize`, and `_dataOffset` fields during `DataDescriptor` message deserialization. An unauthenticated remote attacker can send a crafted network payload that triggers an unsigned integer underflow in `DataDescriptor::getPayloadSize()` and `DataDescriptor::getNextDescriptor()`. This results in an out-of-bounds heap read and an immediate process crash (SIGSEGV), causing a denial of service.","summary":"Eclipse OpenJ9 before 0.63.0 fails to validate size fields in JITServer DataDescriptor messages, causing an unsigned underflow. An unauthenticated remote attacker can send a crafted payload that triggers an out-of-bounds heap read and a SIGSEGV crash, a denial of service.","severity":"high","cvss":8.7,"epss":0.00372,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["eclipse-openj9","java","jitserver","runtime"],"not_affected_if":["jitserver-disabled","non-openj9-jvm"],"how_to_check":"Check whether the JVM runs with JITServer enabled, for example by looking for -XX:+JITServer or -XX:+UseJITServer in the process command line.","fix":"Upgrade Eclipse OpenJ9 to 0.63.0 or later.\nIf JITServer is not used, disabling it removes the exposed component.","status":"open","published_at":"2026-10-21T08:16:42+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-23T22:36:56+00:00","updated_at":"2026-10-24T13:15:54+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-23T22:36:56Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Eclipse OpenJ9 to 0.63.0 or later.\nIf JITServer is not used, disabling it removes the exposed component.","reach":"network","title":"Eclipse OpenJ9: crafted JITServer message crashes the JVM via heap read","impact":"low","summary":"Eclipse OpenJ9 before 0.63.0 fails to validate size fields in JITServer DataDescriptor messages, causing an unsigned underflow. An unauthenticated remote attacker can send a crafted payload that triggers an out-of-bounds heap read and a SIGSEGV crash, a denial of service.","category":"runtime","who_cares":["java","eclipse-openj9","jitserver"],"confidence":0.8,"needs_auth":"no","worst_case":"Remote unauthenticated attacker crashes the JVM process, causing denial of service","analyst_note":"","how_to_check":"Check whether the JVM runs with JITServer enabled, for example by looking for -XX:+JITServer or -XX:+UseJITServer in the process command line.\nunknown","needs_analyst":false,"not_affected_if":["jitserver-disabled","non-openj9-jvm"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000526,"input_tokens":3022,"output_tokens":448,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111075':14A,17A '-2026':13A,16A '0.63.0':27B,73C 'attack':44B,86C,100C 'attacker-control':85C 'bound':56B,126C 'caus':37B,135C 'compon':76C 'control':87C 'craft':3A,48B,104C 'crash':6A,62B,133C 'cross':81C 'cross-field':80C 'cve':12A,15A 'datadescriptor':35B,94C,114C,117C 'dataoffset':91C 'denial':64B,137C 'deseri':96C 'eclips':1A,19B,24B,68C 'eclipse-openj9':18B 'fail':28B,77C 'field':32B,82C,92C 'getnextdescriptor':118C 'getpayloads':115C 'heap':10A,57B,127C 'immedi':131C 'integ':111C 'java':21B 'jitserv':4A,22B,34B,75C 'jvm':8A 'messag':5A,36B,95C 'network':105C 'openj9':2A,20B,25B,69C 'out-of-bound':53B,123C 'paddings':89C 'payload':49B,106C 'perform':79C 'prior':71C 'process':132C 'read':11A,58B,128C 'remot':43B,99C 'result':120C 'runtim':23B 'send':46B,102C 'servic':66B,139C 'sigsegv':61B,134C 'size':31B,88C 'trigger':51B,108C 'unauthent':42B,98C 'underflow':40B,112C 'unsign':39B,110C 'valid':30B,83C 'version':70C 'via':9A","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T08:16:42+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111075","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111075","severity":null,"published_at":"2026-10-21T08:16:42+00:00","modified_at":"2026-10-22T17:21:57+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-111075","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111075","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}