CVE-2026-111074: CWE-190 in Eclipse Foundation Eclipse OpenJ9
Description
Eclipse OpenJ9 versions prior to 0.63.0 contain a vulnerability in the JITServer component where an integer overflow in processing the initial TCP connection length field causes a denial of service. An unauthenticated remote attacker can exploit this by sending crafted TCP connections, leading to infinite CPU consumption and halting compilation services for all connected JVM clients.
CVSS v4.0
Score 8.7high
Affected software
Eclipse Foundation
Eclipse OpenJ9
pkg:github/eclipse-openj9/openj9Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-111074 is a high-severity vulnerability in Eclipse OpenJ9's JITServer component affecting versions prior to 0.63.0. The flaw arises from an integer overflow in the MessageBuffer::computeRequiredCapacity() function when processing the initial 4-byte length field of incoming TCP connections. This overflow causes the compilation worker thread to enter an infinite loop consuming approximately 100% CPU. An unauthenticated remote attacker can exploit this by establishing a small number of specially crafted TCP connections, exhausting the worker thread pool and effectively causing a remote denial of service by halting compilation services for all connected client JVMs.
Potential Impact
The vulnerability allows unauthenticated remote attackers to cause a denial of service by exhausting the compilation worker thread pool through crafted TCP connections. This results in the compilation services becoming unresponsive, impacting all connected JVM clients relying on JITServer for compilation.
Mitigation Recommendations
No explicit patch or remediation information is provided in the vendor advisory. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the JITServer TCP port to trusted hosts only to reduce exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- eclipse
- Date Reserved
- 2026-10-15T13:44:42.349Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad871fc2cdf04f656cd811f
Added to database: 10/21/2026, 08:04:12 UTC
Last enriched: 10/21/2026, 08:18:17 UTC
Last updated: 10/21/2026, 13:40:20 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.