# CVE-2026-110938: Eclipse OpenJ9 JITServer denial of service via out-of-bounds read

Source: https://junglewise.ai/threats/cve-2026-110938-in-eclipse-openj9-versions-up-to-0-63-0-the-jitserver-component  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-110938 · Severity: info · Published 2026-10-21

Eclipse OpenJ9's JITServer component, which accelerates Java application performance through remote compilation, crashes when it receives malformed network messages. An unauthenticated attacker can exploit improper boundary checks to trigger out-of-bounds heap reads, causing immediate service disruption via segmentation fault on both the server and client JVM.

Technologies: [Eclipse Openj9](https://junglewise.ai/threats/technologies/openj9). Vendors: [Eclipse](https://junglewise.ai/threats/vendors/eclipse).

## Quick answers

**Is CVE-2026-110938 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-110938 being exploited in the wild.

**How severe is CVE-2026-110938?** Informational severity, published 21 October 2026.

**Which products and versions are affected?** Eclipse Openj9 up to 0.63.0.

**Is there a fix for CVE-2026-110938?** Yes: fixed in OpenJ9 0.63.0 and later (patched in main branch via PR #25011, merged October 20, 2026). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-110938 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-110938?** Check whether you run Eclipse Openj9 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in OpenJ9 0.63.0 and later (patched in main branch via PR #25011, merged October 20, 2026)

## Technical details

The JITServer protocol parses serialized messages with data descriptors for parameters; a malicious actor can craft descriptors with misrepresented size, padding, and offset values that cause out-of-bounds reads when computing payload sizes. The vulnerability affects message and reply handling in both directions (CWE-125 out-of-bounds read, CWE-20 improper input validation). The fix adds descriptor validation to ensure payload calculations cannot exceed allocated buffer bounds.

## Affected products

- Eclipse OpenJ9 up to 0.63.0

## Timeline

- 2026-10-21: disclosed
- 2026-10-20: patched

## References

- [https://github.com/eclipse-openj9/openj9/pull/25011](https://github.com/eclipse-openj9/openj9/pull/25011)
- [https://gitlab.eclipse.org/security/cve-assignment/-/work_items/407](https://gitlab.eclipse.org/security/cve-assignment/-/work_items/407)

## Related threats

- [Eclipse OpenJ9 JITServer integer underflow in DataDescriptor](https://junglewise.ai/threats/cve-2026-111075-in-eclipse-openj9-versions-prior-to-0-63-0-the-jitserver)
- [Eclipse OpenJ9 JITServer integer overflow denial of service](https://junglewise.ai/threats/cve-2026-111074-in-eclipse-openj9-versions-prior-to-0-63-0-the-jitserver)
- [Eclipse OpenJ9 XXE in jdmpview diagnostic dump handling](https://junglewise.ai/threats/cve-2026-97400-in-eclipse-openj9-versions-up-to-0-63-opening-a-supplied)
- [Eclipse OpenJ9 OOB read and crash in JITServer](https://junglewise.ai/threats/cve-2026-6918-eclipse-openj9-oob-read-and-crash-in-jitserver)