Skip to content
OpenAdvisories
Medium WID-SEC-2026-4459 4 CVEs

IBM Semeru Runtime: Mehrere Schwachstellen

Published Nov 10, 2026 · Updated Nov 10, 2026 · de

Vendor: IBM Product: App Connect Enterprise Product: Semeru Runtime Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Semeru Runtime ausnutzen, um einen Denial of Service Angriff durchzuführen oder Daten zu manipulieren.

Product

IBM Semeru Runtime ist ein Java Runtime Environment.

Vulnerabilities 4

  • High 8.7
    CVE-2026-110938

    JITServer: Multiple Denial of Service vulnerabilities via out-of-bounds heap reads during message and reply parsing

    In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper boundary checks during protocol message and reply handling. An unauthenticated remote attacker or malicious JITServer can transmit malformed ne…

    Eclipse Foundation Eclipse OpenJ9
  • High 8.7
    CVE-2026-111074

    JITServer: Pre-authentication remote Denial of Service via integer overflow infinite loop in MessageBuffer::computeRequiredCapacity()

    In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remote denial of service. When processing the initial 4-byte length field of an incoming TCP connection, an integer overflow in `MessageBuffer::computeRe…

    Eclipse Foundation Eclipse OpenJ9
  • High 8.7
    CVE-2026-111075

    JITServer: Pre-authentication remote crash via integer underflow and out-of-bounds heap read in DataDescriptor deserialization

    In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled `_size`, `_paddingSize`, and `_dataOffset` fields during `DataDescriptor` message deserialization. An unauthenticated remote att…

    Eclipse Foundation Eclipse OpenJ9
  • Medium 6.8
    CVE-2026-97400

    jdmpview / DTFJ reads arbitrary local files and makes arbitrary outbound requests when opening a third-party diagnostic dump bundle (XXE in XMLIndexReader)

    In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an arbitrary local file named inside the bundle and send its contents to an arbitrary rem…

    Eclipse Foundation Eclipse OpenJ9

Revision history

  1. #1

    Initiale Fassung

References