CVE-2026-97400: medium-severity vulnerability in Eclipse OpenJ9
jdmpview / DTFJ reads arbitrary local files and makes arbitrary outbound requests when opening a third-party diagnostic dump bundle (XXE in XMLIndexReader)
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.8epss 0.2%
In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an arbitrary local file named inside the bundle and send its contents to an arbitrary remote host.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
Affected products
Eclipse Foundation · Eclipse OpenJ9Related CVEs — Eclipse OpenJ9
In the same product, most dangerous first.
CVE-2026-6918HIGHCVE-2026-6918EPSS 0.5%CVE-2023-2597HIGHCVE-2023-2597EPSS 0.4%CVE-2026-111074HIGHJITServer: Pre-authentication remote Denial of Service via integer overflow infinite loop in MessageBuffer::computeRequiredCapacity()EPSS 0.4%CVE-2026-110938HIGHJITServer: Multiple Denial of Service vulnerabilities via out-of-bounds heap reads during message and reply parsingEPSS 0.4%CVE-2026-111075HIGHJITServer: Pre-authentication remote crash via integer underflow and out-of-bounds heap read in DataDescriptor deserializationEPSS 0.4%CVE-2026-16440MEDIUMCVE-2026-16440EPSS 0.3%