CVE-2026-6918
Fixed in a distro release EPSS <1%CVSS 8.7
In Eclipse Open9J versions 0.21 to 0.58, a pre-authentication remote attacker can crash JITServer by sending a 32-byte crafted TCP message.
Products: Eclipse Foundation Eclipse OpenJ9, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 10.2 Extended Update Support
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux 10.2 | java-21-ibm-semeru-certified-jdk | 1:21.0.11.0.10-2.el10_1 |
| Red Hat Enterprise Linux 10.2 | java-21-ibm-semeru-certified-jdk-devel | 1:21.0.11.0.10-2.el10_1 |
| Red Hat Enterprise Linux 10.2 | java-21-ibm-semeru-certified-jdk-headless | 1:21.0.11.0.10-2.el10_1 |
| Red Hat Enterprise Linux 10.2 | java-21-ibm-semeru-certified-jdk-jmods | 1:21.0.11.0.10-2.el10_1 |
| Red Hat Enterprise Linux 10.2 | java-21-ibm-semeru-certified-jdk-src | 1:21.0.11.0.10-2.el10_1 |
| Red Hat Enterprise Linux eus 10.0 | java-21-ibm-semeru-certified-jdk | 1:21.0.11.0.10-1.el10_0 |
| Red Hat Enterprise Linux eus 10.0 | java-21-ibm-semeru-certified-jdk-headless | 1:21.0.11.0.10-1.el10_0 |
| Red Hat Enterprise Linux eus 10.2 | java-21-ibm-semeru-certified-jdk | 1:21.0.11.0.10-2.el10_1 |
| Red Hat Enterprise Linux eus 10.2 | java-21-ibm-semeru-certified-jdk-devel | 1:21.0.11.0.10-2.el10_1 |
| Red Hat Enterprise Linux eus 10.2 | java-21-ibm-semeru-certified-jdk-headless | 1:21.0.11.0.10-2.el10_1 |
| Red Hat Enterprise Linux eus 10.2 | java-21-ibm-semeru-certified-jdk-jmods | 1:21.0.11.0.10-2.el10_1 |
| Red Hat Enterprise Linux eus 10.2 | java-21-ibm-semeru-certified-jdk-src | 1:21.0.11.0.10-2.el10_1 |
| Ubuntu 16.04 LTS | eclipse | no fix |
| Ubuntu 18.04 LTS | eclipse | no fix |