CVE-2026-6918

Summary

In Eclipse Open9J versions 0.21 to 0.58, a pre-authentication remote attacker can crash JITServer by sending a 32-byte crafted TCP message.

Affected Software

Weaknesses

• CWE-125: CWE-125 Out-of-bounds read

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: yes
  • Technical Impact: partial

Additional References

• https://github.com/eclipse-openj9/openj9/security/advisories/GHSA-q393-vr4c-969r

Eclipse Open9J: Denial of Service in JITServer via crafted TCP message

Additional References

• https://access.redhat.com/security/cve/CVE-2026-6918
• https://bugzilla.redhat.com/show_bug.cgi?id=2466741
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6918.json
• https://access.redhat.com/errata/RHSA-2026:22328

References

• https://github.com/eclipse-openj9/openj9/security/advisories/GHSA-q393-vr4c-969r
• https://github.com/eclipse-openj9/openj9/pull/23793

• ←Previous
• Next→