PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-111075 Eclipse Foundation CVE debrief

The Eclipse OpenJ9 JITServer component is vulnerable to a pre-authentication remote crash due to an integer underflow and out-of-bounds heap read in DataDescriptor deserialization. This occurs in versions prior to 0.63.0. An unauthenticated remote attacker can send a crafted network payload to trigger this vulnerability, resulting in a process crash (SIGSEGV) and denial of service. Eclipse OpenJ9 users, especially those with exposed JITServer components, should assess their exposure and prioritize upgrading to version 0.63.0 or later. System administrators and security teams responsible for OpenJ9 deployments should verify their inventory and apply the necessary updates. The CVE-

Vendor
Eclipse Foundation
Product
Eclipse OpenJ9
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-21
Original CVE updated
2026-10-26
Advisory published
2026-10-21
Advisory updated
2026-10-26

Who should care

Eclipse OpenJ9 users, especially those with exposed JITServer components, should assess their exposure and prioritize upgrading to version 0.63.0 or later. System administrators and security teams responsible for OpenJ9 deployments should verify their inventory and apply the necessary updates.

Why it matters

CVE-2026-111075 is a high-severity vulnerability in Eclipse OpenJ9's JITServer component that can lead to a denial of service. Users of OpenJ9 should assess their exposure, especially if JITServer is enabled, and prioritize upgrading to version 0.63.0 or later. The vulnerability requires no authentication and can be triggered by a crafted network payload, making it a significant concern for OpenJ9 deployments.

  • Denial of service due to process crash
  • Potential disruption to critical systems or services
  • Need for verification of OpenJ9 version and JITServer exposure
  • Possible impact on system availability and reliability

Technical summary

The JITServer component in Eclipse OpenJ9 versions prior to 0.63.0 is vulnerable to a pre-authentication remote crash due to an integer underflow and out-of-bounds heap read in DataDescriptor deserialization. An unauthenticated remote attacker can send a crafted network payload to trigger this vulnerability, resulting in a process crash (SIGSEGV) and denial of service. The vulnerability requires no authentication and can be triggered by a crafted network payload, making it a significant concern for OpenJ9 deployments. The issue arises from the JITServer component's failure to validate attacker-controlled fields during DataDescriptor message deserialization.

Defensive priority

High priority for OpenJ9 users, especially those with exposed JITServer components

Recommended defensive actions

  • Upgrade Eclipse OpenJ9 to version 0.63.0 or later
  • Disable JITServer component if not required
  • Monitor for and restrict access to JITServer
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

Official CVE Program record and NVD vulnerability detail page confirm the vulnerability in Eclipse OpenJ9 versions prior to 0.63.0. The JITServer component fails to validate attacker-controlled fields during DataDescriptor message deserialization, leading to a denial of service.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-111075 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-111075

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-111075 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-111075

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.