---
id: "CVE-2026-97400"
kind: "vulnerability"
aliases: ["CVE-2026-97400"]
title: "Eclipse OpenJ9: crafted dump bundle leaks local files from analyst machine"
severity: "medium"
cvss: 6.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["dtfj", "java", "jdmpview", "openj9", "runtime"]
not_affected_if: ["no-dump-analysis", "trusted-dumps-only"]
published_at: "2026-10-20T15:17:37+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-25T03:44:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97400", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# Eclipse OpenJ9: crafted dump bundle leaks local files from analyst machine

In Eclipse OpenJ9 up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool or equivalent DTFJ code can make the analyst's machine read a local file named inside the bundle. The file contents can then be sent to a remote host chosen by the attacker.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the `jdmpview` tool or DTFJ code from OpenJ9 is installed and its version, which the sources do not give as a command: unknown
- Review whether your team opens third-party or untrusted dump bundles with these tools: unknown

## Fix

- Upgrade OpenJ9 past version `0.63`; the sources do not name the fixed version: unknown
- Only open diagnostic dump bundles from trusted sources until patched

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-97400

## From the sources

In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an arbitrary local file named inside the bundle and send its contents to an arbitrary remote host.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_