Junglewise Threat Intelligence

CVE-2026-6918: Eclipse OpenJ9 OOB read and crash in JITServer

CVE-2026-6918 · Severity: high · CVSS 7.5 · Published 2026-05-05

Vendors: IBM, Red Hat, Eclipse Foundation, Eclipse.

Executive brief

Eclipse OpenJ9 is a high-performance Java Virtual Machine used in various enterprise applications and cloud environments. A vulnerability in its JITServer component allows an unauthenticated remote attacker to crash the server by sending a specially crafted 32-byte network message. This can lead to a denial-of-service condition, forcing Java applications to run slower in interpreted mode or causing them to become unresponsive.

Technical details

The vulnerability is an out-of-bounds (OOB) heap read in the JITServer's Message::deserialize() function. The root cause is located in MessageBuffer::readData(), which advances an internal cursor based on an attacker-controlled size value from the DataDescriptor._size field without performing bounds checking. By providing a large size value, an attacker can force the cursor to point to unmapped memory; a subsequent read operation then triggers a segmentation fault (SIGSEGV). This attack can be executed over the network against the default JITServer port (38400) without authentication or TLS. The issue is addressed in version 0.59 by adding proper bounds validation.

Affected products

  • Eclipse Foundation OpenJ9 0.21 to 0.58
  • IBM IBM Semeru Runtime Certified Edition 21.0.6.0
  • Red Hat Red Hat Enterprise Linux Supplementary 10, 10.0, 10.2

Timeline

  • 2026-04-21: patched: Fix merged into Eclipse OpenJ9 master branch.
  • 2026-05-05: advisory: Initial disclosure by Eclipse Foundation and NVD.
  • 2026-06-01: patched: Red Hat released security updates for RHEL 10.x.

References