CVE-2026-111074 Eclipse Foundation CVE debrief

Who should care

Defenders and administrators of Eclipse OpenJ9 deployments should assess exposure and prioritize remediation. This vulnerability can lead to a denial of service in Eclipse OpenJ9 deployments, potentially disrupting compilation services and increasing CPU consumption. Remediation priority is high for administrators of affected versions, especially those with high-risk exposure or critical systems relying on Eclipse OpenJ9.

Why it matters

Defenders should care about this vulnerability as it can lead to a denial of service in Eclipse OpenJ9 deployments, potentially disrupting compilation services and increasing CPU consumption. Remediation priority is high for administrators of affected versions.

• Potential disruption of compilation services for connected client JVMs
• Exhaustion of worker thread pools
• Increased CPU consumption by malicious actors

Technical summary

The JITServer component in Eclipse OpenJ9 versions prior to 0.63.0 is vulnerable to a pre-authentication remote denial of service due to an integer overflow in `MessageBuffer::computeRequiredCapacity()`. This vulnerability allows an unauthenticated remote attacker to cause a denial of service by consuming 100% CPU through an infinite loop. The attack can be performed by opening a small number of crafted TCP connections, which can exhaust the entire worker thread pool and halt compilation services for all connected client JVMs.

Defensive priority

High

Recommended defensive actions

• Review and apply patches for Eclipse OpenJ9 versions prior to 0.63.0
• Restrict access to the JITServer component
• Monitor for unusual activity and consumption patterns
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability in Eclipse OpenJ9 versions prior to 0.63.0. The JITServer component is vulnerable to a pre-authentication remote denial of service due to an integer overflow in `MessageBuffer::computeRequiredCapacity()`.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.