Is CVE-2026-6918 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6918 being exploited in the wild.

How severe is CVE-2026-6918?

High severity, with a CVSS score of 7.5, published 5 May 2026.

Which products and versions are affected?

IBM Semeru Runtime Certified Edition 21.0.6.0; Red Hat Enterprise Linux Supplementary 10, 10.0, 10.2.

Is there a fix for CVE-2026-6918?

A patch was published on 2026-04-21: Fix merged into Eclipse OpenJ9 master branch. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-6918 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-6918?

Check whether you run Eclipse Openj9, IBM Semeru Runtime Certified Edition or Red Hat Enterprise Linux Supplementary at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6918: Eclipse OpenJ9 OOB read and crash in JITServer

CVE-2026-6918 · Severity: high · CVSS 7.5 · Published 2026-05-05

Eclipse OpenJ9 is a high-performance Java Virtual Machine used in various enterprise applications and cloud environments. A vulnerability in its JITServer component allows an unauthenticated remote attacker to crash the server by sending a specially crafted 32-byte network message. This can lead to a denial-of-service condition, forcing Java applications to run slower in interpreted mode or causing them to become unresponsive.

Technologies: Eclipse Openj9. Vendors: Eclipse, IBM, Red Hat.

Quick answers

Is CVE-2026-6918 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6918 being exploited in the wild.
How severe is CVE-2026-6918?: High severity, with a CVSS score of 7.5, published 5 May 2026.
Which products and versions are affected?: IBM Semeru Runtime Certified Edition 21.0.6.0; Red Hat Enterprise Linux Supplementary 10, 10.0, 10.2.
Is there a fix for CVE-2026-6918?: A patch was published on 2026-04-21: Fix merged into Eclipse OpenJ9 master branch. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-6918 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-6918?: Check whether you run Eclipse Openj9, IBM Semeru Runtime Certified Edition or Red Hat Enterprise Linux Supplementary at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an out-of-bounds (OOB) heap read in the JITServer's Message::deserialize() function. The root cause is located in MessageBuffer::readData(), which advances an internal cursor based on an attacker-controlled size value from the DataDescriptor._size field without performing bounds checking. By providing a large size value, an attacker can force the cursor to point to unmapped memory; a subsequent read operation then triggers a segmentation fault (SIGSEGV). This attack can be executed over the network against the default JITServer port (38400) without authentication or TLS. The issue is addressed in version 0.59 by adding proper bounds validation.

Affected products

Eclipse Foundation OpenJ9 0.21 to 0.58
IBM IBM Semeru Runtime Certified Edition 21.0.6.0
Red Hat Red Hat Enterprise Linux Supplementary 10, 10.0, 10.2

Timeline

2026-04-21: patched: Fix merged into Eclipse OpenJ9 master branch.
2026-05-05: advisory: Initial disclosure by Eclipse Foundation and NVD.
2026-06-01: patched: Red Hat released security updates for RHEL 10.x.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.