# CVE-2026-97400: Eclipse OpenJ9 XXE in jdmpview diagnostic dump handling

Source: https://junglewise.ai/threats/cve-2026-97400-in-eclipse-openj9-versions-up-to-0-63-opening-a-supplied  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-97400 · Severity: info · Published 2026-10-20

Eclipse OpenJ9 is a Java virtual machine used in enterprise environments. When an analyst opens a crafted diagnostic dump bundle using the jdmpview tool, an attacker can trick the analyst's machine into reading arbitrary local files and sending their contents to a remote server. This could expose sensitive configuration files, credentials, or other confidential data.

Technologies: [Eclipse Openj9](https://junglewise.ai/threats/technologies/openj9). Vendors: [Eclipse](https://junglewise.ai/threats/vendors/eclipse).

## Quick answers

**Is CVE-2026-97400 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-97400 being exploited in the wild.

**How severe is CVE-2026-97400?** Informational severity, published 20 October 2026.

**Which products and versions are affected?** Eclipse Openj9 0.8.0 to 0.62.x.

**Is there a fix for CVE-2026-97400?** Yes: fixed in 0.63. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-97400 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-97400?** Check whether you run Eclipse Openj9 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.63

## Technical details

The vulnerability is an XML External Entity (XXE) injection in the XMLIndexReader component of DTFJ, triggered when parsing a diagnostic dump bundle. An attacker crafts a malicious dump bundle with a specially-formatted XML metadata file that references external entities pointing to local files and/or remote hosts. When jdmpview or equivalent DTFJ code opens the bundle, it processes the XXE payload, reading arbitrary local files and making outbound network connections. Affected versions are 0.8.0 through 0.62.x; the fix removes legacy DTFJ image support as of version 0.63.

## Affected products

- Eclipse OpenJ9 0.8.0 to 0.62.x

## Timeline

- 2026-10-20: disclosed
- 2026-10-19: patched: Fix merged into v0.63.0-release branch

## References

- [https://github.com/eclipse-openj9/openj9/pull/25003](https://github.com/eclipse-openj9/openj9/pull/25003)
- [https://gitlab.eclipse.org/security/cve-assignment/-/work_items/324](https://gitlab.eclipse.org/security/cve-assignment/-/work_items/324)

## Related threats

- [Eclipse OpenJ9 JITServer denial of service via out-of-bounds read](https://junglewise.ai/threats/cve-2026-110938-in-eclipse-openj9-versions-up-to-0-63-0-the-jitserver-component)
- [Eclipse OpenJ9 JITServer integer underflow in DataDescriptor](https://junglewise.ai/threats/cve-2026-111075-in-eclipse-openj9-versions-prior-to-0-63-0-the-jitserver)
- [Eclipse OpenJ9 JITServer integer overflow denial of service](https://junglewise.ai/threats/cve-2026-111074-in-eclipse-openj9-versions-prior-to-0-63-0-the-jitserver)
- [Eclipse OpenJ9 OOB read and crash in JITServer](https://junglewise.ai/threats/cve-2026-6918-eclipse-openj9-oob-read-and-crash-in-jitserver)