Eclipse OpenJ9 JITServer: Denial of service via out-of-bounds heap read

Summary

Eclipse OpenJ9 up to 0.63.0 contains several flaws in the JITServer component, which lets a JVM offload JIT compilation to a separate, possibly remote, process. Insufficient boundary checks when parsing protocol messages and replies allow out-of-bounds heap reads. An unauthenticated remote attacker or a malicious JITServer can send malformed payloads that crash the JITServer daemon or the client JVM with a segmentation fault (SIGSEGV). The impact is limited to availability; no confidentiality or integrity impact is claimed.

Affected

• Eclipse OpenJ9 up to 0.63.0 (CNA description; the machine-readable range reads 0.8.0 to less than 0.63, so 0.63.0 is treated as affected until Eclipse clarifies)
• Only deployments with JITServer enabled are affected (not enabled by default)

Fixed in

Unknown. Sources conflict. The fix is in PR #25011 and related commits (#25005-#25009) in the 0.63.0 release line. OpenCVE recommends 0.64.0 or later; VulDB states that 0.63.0 removes the vulnerability. Confirm the fixed version with the Eclipse advisory.

Workaround

• Disable JITServer (do not use -XX:+UseJITServer) if it is not required
• Restrict network access to the JITServer port (set with -XX:JITServerPort) to trusted client hosts only, e.g. with firewall rules

Exploitation

• Unknown whether public exploit code exists.
• CISA SSVC: exploitation none, automatable yes, technical impact partial.
• No known active exploitation.

Our recommendation

• Check whether JITServer is used (look for -XX:+UseJITServer and -XX:JITServerPort in JVM startup options)
• If used, update OpenJ9 to the fixed version once confirmed by Eclipse, or at least to 0.64.0 or later
• Until patched, apply the workarounds and limit the JITServer port to trusted hosts
• Monitor JVM crash logs and JITServer restarts for signs of abuse

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Eclipse OpenJ9 PR #25011 (JITServer buffer overrun fix) github.com
• Eclipse CVE assignment work item 407 gitlab.eclipse.org
• OpenJ9 0.63.0 release github.com
• VulDB entry CVE-2026-110938 vuldb.com
• OpenCVE CVE-2026-110938 app.opencve.io
• VulnRichment CVE-2026-110938 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 01:03.