CVE-2026-6918 is an out-of-bounds read vulnerability (CWE-125) in the Eclipse OpenJ9 JITServer component. It affects versions 0.21 through 0.58. An unauthenticated remote attacker can send a crafted 32-byte TCP message to the JITServer, causing it to crash and resulting in a denial of service. The vulnerability has a CVSS 4.0 base score of 8.7 (high severity) with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on availability. Red Hat has published an advisory with patches for their java-21-ibm-semeru-certified-jdk packages that include the fix for this issue.

Successful exploitation of this vulnerability results in a denial of service condition by crashing the JITServer component of Eclipse OpenJ9. This can disrupt services relying on JITServer, impacting availability. There is no indication of confidentiality or integrity impact. No known exploits are currently reported in the wild.

Red Hat has released security updates for the java-21-ibm-semeru-certified-jdk packages in Red Hat Enterprise Linux 10 and its Extended Update Support versions that address this vulnerability. Users should apply these official patches as detailed in the Red Hat advisory (https://access.redhat.com/errata/RHSA-2026:22328). Since this is not a cloud service, remediation requires applying the vendor-provided updates. Patch status is confirmed by the vendor advisory. No alternative mitigations are specified.