6.8
Medium
CVE-2026-97400 In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent…
Description
In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an arbitrary local file named inside the bundle and send its contents to an arbitrary remote host.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Eclipse OpenJ9 0.8 | 0.8.0 → < 0.63 | 0.63 |
Other CVEs of Eclipse OpenJ9
The 7 CVEs of Eclipse OpenJ9 →
CVE-2026-110938
In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper…
8.7
High
CVE-2026-111075
In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on…
8.7
High
CVE-2026-111074
In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remote…
8.7
High
CVE-2026-16440
In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a segmentation fault
5.7
Medium