# CVE-2026-111074: Eclipse OpenJ9 JITServer integer overflow denial of service

Source: https://junglewise.ai/threats/cve-2026-111074-in-eclipse-openj9-versions-prior-to-0-63-0-the-jitserver  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-111074 · Severity: info · Published 2026-10-21

Eclipse OpenJ9's JITServer component, which performs remote compilation optimization for Java applications, contains an integer overflow vulnerability in message processing. An unauthenticated attacker can send crafted network packets to trigger infinite loops that consume all CPU and halt compilation services across all connected client JVMs, causing a silent service outage.

Technologies: [Eclipse Openj9](https://junglewise.ai/threats/technologies/openj9). Vendors: [Eclipse](https://junglewise.ai/threats/vendors/eclipse).

## Quick answers

**Is CVE-2026-111074 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111074 being exploited in the wild.

**How severe is CVE-2026-111074?** Informational severity, published 21 October 2026.

**Which products and versions are affected?** Eclipse Openj9 prior to 0.63.0.

**Is there a fix for CVE-2026-111074?** Yes: fixed in OpenJ9 0.63.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111074 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-111074?** Check whether you run Eclipse Openj9 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in OpenJ9 0.63.0

## Technical details

An integer overflow in MessageBuffer::computeRequiredCapacity() occurs when processing the initial 4-byte TCP length field, causing compilation worker threads to enter infinite loops consuming ~100% CPU. The vulnerability is pre-authentication and requires only network access; an attacker opens a small number of crafted connections to exhaust the worker thread pool. The fix adds a 1 GB size limit for incoming messages to prevent both excessive memory allocation and the infinite loop condition.

## Affected products

- Eclipse OpenJ9 prior to 0.63.0

## Timeline

- 2026-10-21: disclosed
- 2026-10-20: patched

## References

- [https://github.com/eclipse-openj9/openj9/pull/25008](https://github.com/eclipse-openj9/openj9/pull/25008)
- [https://gitlab.eclipse.org/security/cve-assignment/-/work_items/422](https://gitlab.eclipse.org/security/cve-assignment/-/work_items/422)

## Related threats

- [Eclipse OpenJ9 JITServer denial of service via out-of-bounds read](https://junglewise.ai/threats/cve-2026-110938-in-eclipse-openj9-versions-up-to-0-63-0-the-jitserver-component)
- [Eclipse OpenJ9 JITServer integer underflow in DataDescriptor](https://junglewise.ai/threats/cve-2026-111075-in-eclipse-openj9-versions-prior-to-0-63-0-the-jitserver)
- [Eclipse OpenJ9 XXE in jdmpview diagnostic dump handling](https://junglewise.ai/threats/cve-2026-97400-in-eclipse-openj9-versions-up-to-0-63-opening-a-supplied)
- [Eclipse OpenJ9 OOB read and crash in JITServer](https://junglewise.ai/threats/cve-2026-6918-eclipse-openj9-oob-read-and-crash-in-jitserver)