Eclipse OpenJ9 versions 0.21 through 0.58 contain an out-of-bounds read vulnerability (CWE-125) in the JITServer component. An attacker without authentication can remotely send a crafted 32-byte TCP message that triggers this flaw, causing the JITServer to crash. This results in a denial of service condition. The CVSS 4.0 base score is 8.7, reflecting high severity due to network attack vector, no required privileges, and high impact on availability. No vendor advisory or patch information is provided, and the vulnerability is not in a cloud service context.

The primary impact is denial of service against the JITServer in affected Eclipse OpenJ9 versions, potentially disrupting services relying on JITServer. There is no evidence of code execution or data compromise. The vulnerability can be exploited remotely without authentication, increasing risk of service interruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting network access to the JITServer component to trusted sources to reduce exposure. Monitor for unusual crashes or disruptions related to JITServer. No official fix or temporary workaround has been published by the vendor at this time.