CVE-2026-97400: falha de média gravidade em Eclipse OpenJ9
jdmpview / DTFJ reads arbitrary local files and makes arbitrary outbound requests when opening a third-party diagnostic dump bundle (XXE in XMLIndexReader)
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.8epss 0.2%
In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an arbitrary local file named inside the bundle and send its contents to an arbitrary remote host.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
Produtos afetados
Eclipse Foundation · Eclipse OpenJ9CVEs relacionadas — Eclipse OpenJ9
No mesmo produto, das mais perigosas para as menos.
CVE-2026-6918HIGHCVE-2026-6918EPSS 0.5%CVE-2023-2597HIGHCVE-2023-2597EPSS 0.4%CVE-2026-111074HIGHJITServer: Pre-authentication remote Denial of Service via integer overflow infinite loop in MessageBuffer::computeRequiredCapacity()EPSS 0.4%CVE-2026-110938HIGHJITServer: Multiple Denial of Service vulnerabilities via out-of-bounds heap reads during message and reply parsingEPSS 0.4%CVE-2026-111075HIGHJITServer: Pre-authentication remote crash via integer underflow and out-of-bounds heap read in DataDescriptor deserializationEPSS 0.4%CVE-2026-16440MEDIUMCVE-2026-16440EPSS 0.3%