CVE-2026-111075
CVE-2026-111075 · JITServer: Pre-authentication remote crash via integer underflow and out-of-bounds heap read in DataDescriptor deserialization
This page contains facts from public vulnerability sources. Check the original advisory before updating.
In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled `_size`, `_paddingSize`, and `_dataOffset` fields during `DataDescriptor` message deserialization. An unauthenticated remote attacker can send a crafted network payload that triggers an unsigned integer underflow in `DataDescriptor::getPayloadSize()` and `DataDescriptor::getNextDescriptor()`. This results in an out-of-bounds heap read and an immediate process crash (SIGSEGV), causing a denial of service.
CVSS 8.7 · High · EPSS 0.4% · Fix available
- Published
- Updated
Affected products and versions
eclipse openj9
- Versions
- ≥ 0.8.0, < 0.63: Affected (semver)
Update to 0.63