Live › vulnerability › CVE-2026-97400
Go to dashboardIn Eclipse OpenJ9 up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool or equivalent DTFJ code can make the analyst's machine read a local file named inside the bundle. The file contents can then be sent to a remote host chosen by the attacker.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that use the OpenJ9 jdmpview tool or DTFJ code to analyse Java diagnostic dump bundles, especially those who open dumps supplied by others. The sources do not describe a server-side exposure or a default configuration that enables it. Teams that only run OpenJ9 as a JVM and never analyse dumps are unlikely to be exposed.
No product ranges from the sources yet.
jdmpview tool or DTFJ code from OpenJ9 is installed and its version, which the sources do not give as a command: unknown0.63; the sources do not name the fixed version: unknownEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an arbitrary local file named inside the bundle and send its contents to an arbitrary remote host.
This page as .md · .json · in your agent: get_signal("CVE-2026-97400")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.