{"id":"CVE-2026-97400","kind":"vulnerability","aliases":["CVE-2026-97400"],"related":[],"title":"Eclipse OpenJ9: crafted dump bundle leaks local files from analyst machine","description":"In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an arbitrary local file named inside the bundle and send its contents to an arbitrary remote host.","summary":"In Eclipse OpenJ9 up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool or equivalent DTFJ code can make the analyst's machine read a local file named inside the bundle. The file contents can then be sent to a remote host chosen by the attacker.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dtfj","java","jdmpview","openj9","runtime"],"not_affected_if":["no-dump-analysis","trusted-dumps-only"],"how_to_check":"- Check whether the `jdmpview` tool or DTFJ code from OpenJ9 is installed and its version, which the sources do not give as a command: unknown\n- Review whether your team opens third-party or untrusted dump bundles with these tools: unknown","fix":"- Upgrade OpenJ9 past version `0.63`; the sources do not name the fixed version: unknown\n- Only open diagnostic dump bundles from trusted sources until patched","status":"open","published_at":"2026-10-20T15:17:37+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:44:43+00:00","updated_at":"2026-10-25T03:44:43+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T03:44:43Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade OpenJ9 past version `0.63`; the sources do not name the fixed version: unknown\n- Only open diagnostic dump bundles from trusted sources until patched","reach":"local","title":"Eclipse OpenJ9: crafted dump bundle leaks local files from analyst machine","impact":"medium","summary":"In Eclipse OpenJ9 up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool or equivalent DTFJ code can make the analyst's machine read a local file named inside the bundle. The file contents can then be sent to a remote host chosen by the attacker.","category":"runtime","nicknames":[],"who_cares":["openj9","java","jdmpview","dtfj"],"confidence":0.6,"needs_auth":"no","worst_case":"local files on analyst machine are sent to remote host","analyst_note":"Check the Eclipse OpenJ9 advisory or NVD references for the fixed version and any workaround; the sources here give neither.","how_to_check":"- Check whether the `jdmpview` tool or DTFJ code from OpenJ9 is installed and its version, which the sources do not give as a command: unknown\n- Review whether your team opens third-party or untrusted dump bundles with these tools: unknown","needs_analyst":true,"not_affected_if":["no-dump-analysis","trusted-dumps-only"],"who_is_affected":"Teams that use the OpenJ9 jdmpview tool or DTFJ code to analyse Java diagnostic dump bundles, especially those who open dumps supplied by others. The sources do not describe a server-side exposure or a default configuration that enables it. Teams that only run OpenJ9 as a JVM and never analyse dumps are unlikely to be exposed.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000657,"input_tokens":3333,"output_tokens":647,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-97400':14A,17A '0.63':28B,78C 'analyst':10A,46B,96C 'arbitrari':102C,115C 'attack':71B 'bundl':5A,34B,56B,84C,108C 'caus':94C 'chosen':68B 'code':42B,92C 'content':59B,112C 'craft':3A 'cve':12A,15A 'diagnost':32B,82C 'dtfj':18B,41B,91C 'dump':4A,33B,83C 'eclips':1A,24B,73C 'equival':40B,90C 'file':8A,52B,58B,104C 'host':67B,117C 'insid':54B,106C 'java':19B 'jdmpview':20B,37B,87C 'leak':6A 'local':7A,51B,103C 'machin':11A,48B,98C 'make':44B 'may':93C 'name':53B,105C 'open':29B,79C 'openj9':2A,21B,25B,74C 'read':49B,100C 'remot':66B,116C 'runtim':22B 'send':110C 'sent':63B 'suppli':31B,81C 'tool':38B,88C 'version':75C","nicknames":[],"mitigations":[],"who_affected":"Teams that use the OpenJ9 jdmpview tool or DTFJ code to analyse Java diagnostic dump bundles, especially those who open dumps supplied by others. The sources do not describe a server-side exposure or a default configuration that enables it. Teams that only run OpenJ9 as a JVM and never analyse dumps are unlikely to be exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T15:17:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97400","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97400","severity":null,"published_at":"2026-10-20T15:17:37+00:00","modified_at":"2026-10-20T19:48:50+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}