Description (CNA)
In Eclipse Open9J versions 0.21 to 0.58, a pre-authentication remote attacker can crash JITServer by sending a 32-byte crafted TCP message.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Eclipse Foundation / Eclipse OpenJ9 | affected 0.21 before 0.59 |
CWE
CWE-125
References
- https://github.com/eclipse-openj9/openj9/security/advisories/GHSA-q393-vr4c-969r
- https://github.com/eclipse-openj9/openj9/pull/23793
ADP enrichment
No English description supplied.
A flaw was found in Eclipse Open9J and JITServer. A remote attacker, without needing to authenticate, can send a specially crafted 32-byte TCP message to JITServer. This action can cause JITServer to crash, leading to a Denial of Service (DoS) for affected systems.