CVE-2026-111074: In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remo

This month

HIGH 8.7REMOTE

CVE-2026-111074 is a high-severity flaw (CVSS 8.7) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remote denial of service. When processing the initial 4-byte length field of an incoming TCP connection, an integer overflow in `MessageBuffer::computeRequiredCapacity()` causes the receiving compilation worker thread to enter an infinite loop consuming ~100% CPU. An unauthenticated remote attacker can exploit this by opening a small number o

Why this priority

High severity
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	8.7 (High)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	0.4% (top 65%)
CISA exploited list	No
Weakness	CWE-190, CWE-835
Published	2026-10-21
Last modified	2026-10-22

Publisher (CNA): Eclipse Foundation

Timeline

2026-10-21Published CVE record published
2026-10-22 17:21 UTCUpdated Record last modified

Exact fixes by distribution

Fedora 46 · uv · FIXED · 0.13.5-1.fc46 · FEDORA-2026-61ea5a28c6 · source

sudo dnf upgrade --advisory=FEDORA-2026-61ea5a28c6

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

References

← Back to latest CVEs