---
id: "CVE-2026-111075"
kind: "vulnerability"
aliases: ["CVE-2026-111075"]
title: "Eclipse OpenJ9: crafted JITServer message crashes the JVM via heap read"
severity: "high"
cvss: 8.7
epss: 0.00372
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["eclipse-openj9", "java", "jitserver", "runtime"]
not_affected_if: ["jitserver-disabled", "non-openj9-jvm"]
published_at: "2026-10-21T08:16:42+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-24T13:15:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111075", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-111075", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Eclipse OpenJ9: crafted JITServer message crashes the JVM via heap read

Eclipse OpenJ9 before 0.63.0 fails to validate size fields in JITServer DataDescriptor messages, causing an unsigned underflow. An unauthenticated remote attacker can send a crafted payload that triggers an out-of-bounds heap read and a SIGSEGV crash, a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check whether the JVM runs with JITServer enabled, for example by looking for -XX:+JITServer or -XX:+UseJITServer in the process command line.

## Fix

Upgrade Eclipse OpenJ9 to 0.63.0 or later.
If JITServer is not used, disabling it removes the exposed component.

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111075
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-111075

## From the sources

In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled `_size`, `_paddingSize`, and `_dataOffset` fields during `DataDescriptor` message deserialization. An unauthenticated remote attacker can send a crafted network payload that triggers an unsigned integer underflow in `DataDescriptor::getPayloadSize()` and `DataDescriptor::getNextDescriptor()`. This results in an out-of-bounds heap read and an immediate process crash (SIGSEGV), causing a denial of service.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_