Eclipse OpenJ9 JITServer: Pre-authentication denial of service via integer overflow
Summary
Eclipse OpenJ9 versions before 0.63.0 contain a flaw in the JITServer component. An integer overflow in MessageBuffer::computeRequiredCapacity() makes a compilation worker thread loop endlessly when it processes the length field of a crafted TCP connection. An unauthenticated remote attacker can open a few such connections to exhaust the worker thread pool, which halts JIT compilation for all connected client JVMs. The issue only affects hosts that run a JITServer process and accept network connections from untrusted sources.
Affected
- Eclipse OpenJ9 from 0.8.0 up to, but not including, 0.63.0 (lower bound as stated by the CNA record)
- Only deployments that run the JITServer component are affected; default OpenJ9 usage is unaffected
Fixed in
- Eclipse OpenJ9 0.63.0 (also contains the fix for related CVEs disclosed on the same day)
Workaround
- No vendor workaround documented.
- Restrict access to the JITServer port (default TCP 38400 per related advisory) with firewall rules so only trusted client JVMs can connect.
- Enabling TLS with client authentication is a reasonable hardening step; it has not been confirmed to block this specific CVE.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- No known exploitation in the wild and no public proof of concept for this CVE found at the time of writing.
- A related GitHub advisory (GHSA-q393-vr4c-969r) describes a separate pre-authentication crash in JITServer and contains PoC material.
Our recommendation
- Check whether any OpenJ9 JITServer process is running, including container and Kubernetes deployments.
- If JITServer is reachable from untrusted networks, upgrade to OpenJ9 0.63.0 promptly.
- If JITServer is internal only, patch in the normal cycle and restrict access by firewall rules.
- Monitor for unusual CPU usage and stalled JIT compilation on JITServer hosts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Eclipse OpenJ9 PR #25008 (JITServer: refuse messages larger than 1GB) github.com
- Eclipse OpenJ9 0.63.0 release notes github.com
- Eclipse OpenJ9 PR #25009 (descriptor validation) github.com
- GitHub Security Advisory GHSA-q393-vr4c-969r github.com
- Eclipse CVE work item 422 gitlab.eclipse.org
- Eclipse vulnerability report work item 940 gitlab.eclipse.org
- VulDB CVE-2026-111074 vuldb.com
- Vulners VULNRICHMENT CVE-2026-111074 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 01:03.
Original description (NVD)
In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remote denial of service. When processing the initial 4-byte length field of an incoming TCP connection, an integer overflow in `MessageBuffer::computeRequiredCapacity()` causes the receiving compilation worker thread to enter an infinite loop consuming ~100% CPU. An unauthenticated remote attacker can exploit this by opening a small number of crafted TCP connections to exhaust the entire worker thread pool, silently halting compilation services for all connected client JVMs.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.