Eclipse Foundation Vulnerabilities and Affected Products
Vulnerabilities associated with OpenJ9.
Products
Clear product- Eclipse Glassfish12 vulnerabilities
- ThreadX12 vulnerabilities
- NetX Duo11 vulnerabilities
- Eclipse Theia10 vulnerabilities
- Eclipse Jetty9 vulnerabilities
- Eclipse Milo6 vulnerabilities
- Jetty6 vulnerabilities
- Eclipse OMR4 vulnerabilities
- Eclipse Vert.x4 vulnerabilities
- Mosquitto4 vulnerabilities
- OpenJ94 vulnerabilities
- USBX4 vulnerabilities
- Eclipse CSI - PIA3 vulnerabilities
- Eclipse BaSyx2 vulnerabilities
- Eclipse KUKSA - Databroker2 vulnerabilities
- Eclipse Open VSX2 vulnerabilities
- Eclipse OpenJ92 vulnerabilities
- Eclipse OpenMQ2 vulnerabilities
- Eclipse ThreadX - NetX Duo2 vulnerabilities
- Glassfish2 vulnerabilities
- NextX Duo2 vulnerabilities
- Open J92 vulnerabilities
- Parsson2 vulnerabilities
- Vert.x2 vulnerabilities
- BlueChi1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-16441MEDIUM | Eclipse OpenJ9 : Method resolution default method precedence failureIn Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstract, execution is incorrectly delegated to an interface default method. CWE-758Jul 21, 2026 | CVSS6.9v4.0 | EPSS0.297% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-16439MEDIUM | Eclipse OpenJ9 : Using -Xtrace to trace method arguments can lead to buffer underflowIn Eclipse OpenJ9 versions up to 0.60, using -Xtrace to trace method arguments can lead to buffer underflow. CWE-124Jul 21, 2026 | CVSS5.8v4.0 | EPSS0.24% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-4447HIGH | Buffer Overflow in Eclipse OpenJ9In Eclipse OpenJ9 versions up to 0.51, when used with OpenJDK version 8 a stack based buffer overflow can be caused by modifying a file on disk that is read when the JVM starts. CWE-121May 9, 2025 | CVSS7.0v4.0 | EPSS0.189% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-5676MEDIUM | Eclipse OpenJ9 possible infinite busy hangIn Eclipse OpenJ9 before version 0.41.0, the JVM can be forced into an infinite busy hang on a spinlock or a segmentation fault if a shutdown signal (SIGTERM, SIGINT or SIGHUP) is received before the JVM has finished initializing. | CVSS4.1v3.1 | EPSS0.41% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |