CVE-2026-111074

{
  "etk_id": "ETK-2026-2300",
  "cve_id": "CVE-2026-111074",
  "display_id": "CVE-2026-111074",
  "ghsa_id": "GHSA-rr74-gf97-xpw7",
  "euvd_id": "EUVD-2026-107134",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Integer overflow denial of service in Eclipse OpenJ9 JITServer",
  "summary": "Eclipse OpenJ9 versions before 0.63 are affected in the JITServer component. An unauthenticated remote client can exhaust JITServer compilation workers and disrupt compilation services when the JITServer TCP endpoint is reachable.",
  "mitigation": "Upgrade Eclipse OpenJ9 to version 0.63 or later. Until upgrading, restrict network access to the JITServer TCP endpoint to trusted clients.",
  "vendor": "Eclipse Foundation",
  "product": "Eclipse OpenJ9",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0.8.0, < 0.63"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "0.63"
      ],
      "package_name": "Eclipse OpenJ9",
      "purl": null
    }
  ],
  "cwes": [
    190
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 85.48356876666666,
  "t0_at": "2026-10-21T07:57:16.912000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-21T07:57:16.912000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-21T07:57:16.912000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111074"
    }
  }
}