CVE-2020-27221
In Eclipse OpenJ9 up to version 0.23, there is potential for a stack-based buffer overflow when...
9.8 Critical
In Eclipse OpenJ9 up to and including version 0.23, there is potential for a stack-based buffer overflow when the virtual machine or JNI natives are converting from UTF-8 characters to platform encoding.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
1.55%Up 1.1 points since Apr 14, 2021
What each source reports
NVD Score used
In Eclipse OpenJ9 up to and including version 0.23, there is potential for a stack-based buffer overflow when the virtual machine or JNI natives are converting from UTF-8 characters to platform encoding.
- Record
CVE-2020-27221- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-121, CWE-787
- Updated
- 2026-11-02
CVE List No score
In Eclipse OpenJ9 up to and including version 0.23, there is potential for a stack-based buffer overflow when the virtual machine or JNI natives are converting from UTF-8 characters to platform encoding.
- Record
CVE-2020-27221- Weakness
- CWE-121
- Updated
- 2026-11-02
EUVDEUVD-2020-19736 No score
In Eclipse OpenJ9 up to and including version 0.23, there is potential for a stack-based buffer overflow when the virtual machine or JNI natives are converting from UTF-8 characters to platform encoding.
- Record
EUVD-2020-19736- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-768g-gf3v-34vm
In Eclipse OpenJ9 up to version 0.23, there is potential for a stack-based buffer overflow when...
In Eclipse OpenJ9 up to version 0.23, there is potential for a stack-based buffer overflow when the virtual machine or JNI natives are converting from UTF-8 characters to platform encoding.
- Record
GHSA-768g-gf3v-34vm- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-121, CWE-787
- Updated
- 2026-11-02
OSV
In Eclipse OpenJ9 up to and including version 0.23, there is potential for a stack-based buffer overflow when the virtual machine or JNI natives are converting from UTF-8 characters to platform encoding.
- Record
CVE-2020-27221- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2021:0717
Red Hat Security Advisory: java-1.8.0-ibm security update
- Record
RHSA-2021:0717- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 8 moreShow less
OSVRHSA-2021:0733
Red Hat Security Advisory: java-1.7.1-ibm security update
- Record
RHSA-2021:0733- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2021:0736
Red Hat Security Advisory: java-1.8.0-ibm security update
- Record
RHSA-2021:0736- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-27221
In Eclipse OpenJ9 up to and including version 0.23, there is potential for a stack-based buffer overflow when the virtual machine or JNI natives are converting from UTF-8 characters to platform encoding.
- Record
UBUNTU-CVE-2020-27221- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVSUSE-SU-2021:0512-1 No score
Security update for java-1_7_1-ibm
This update for java-1_7_1-ibm fixes the following issues:
- Update to Java 7.1 Service Refresh 4 Fix Pack 80
[bsc#1182186, bsc#1181239, CVE-2020-27221, CVE-2020-14803]
- CVE-2020-27221: Potential for a stack-based buffer overflow when the virtual machine or JNI natives are converting from UTF-8 characters to platform encoding.
- CVE-2020-14803: Unauthenticated attacker with network access via multiple protocols allows to compromise Java SE.
- Record
SUSE-SU-2021:0512-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:0652-1 No score
Security update for java-1_8_0-ibm
This update for java-1_8_0-ibm fixes the following issues:
- Update to Java 8.0 Service Refresh 6 Fix Pack 25
[bsc#1182186, bsc#1181239, CVE-2020-27221, CVE-2020-14803]
- CVE-2020-27221: Potential for a stack-based buffer overflow when the virtual machine or JNI natives are converting from UTF-8 characters to platform encoding.
- CVE-2020-14803: Unauthenticated attacker with network access via multiple protocols allows to compromise Java SE.
- Record
SUSE-SU-2021:0652-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:0670-1 No score
Security update for java-1_8_0-ibm
This update for java-1_8_0-ibm fixes the following issues:
- Update to Java 8.0 Service Refresh 6 Fix Pack 25
[bsc#1182186, bsc#1181239, CVE-2020-27221, CVE-2020-14803]
- CVE-2020-27221: Potential for a stack-based buffer overflow when the virtual machine or JNI natives are converting from UTF-8 characters to platform encoding.
- CVE-2020-14803: Unauthenticated attacker with network access via multiple protocols allows to compromise Java SE.
- Record
SUSE-SU-2021:0670-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:14634-1 No score
Security update for java-1_7_1-ibm
This update for java-1_7_1-ibm fixes the following issues:
- Update to Java 7.1 Service Refresh 4 Fix Pack 80
[bsc#1182186, bsc#1181239, CVE-2020-27221, CVE-2020-14803]
- CVE-2020-27221: Potential for a stack-based buffer overflow when the virtual machine or JNI natives are converting from UTF-8 characters to platform encoding.
- CVE-2020-14803: Unauthenticated attacker with network access via multiple protocols allows to compromise Java SE.
- Record
SUSE-SU-2021:14634-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:14640-1 No score
Security update for java-1_7_0-ibm
This update for java-1_7_0-ibm fixes the following issues:
- Update to Java 7.0 Service Refresh 10 Fix Pack 80
[bsc#1182186, bsc#1181239, CVE-2020-27221, CVE-2020-14803]
- CVE-2020-27221: Potential for a stack-based buffer overflow when the virtual machine or JNI natives are converting from UTF-8 characters to platform encoding.
- CVE-2020-14803: Unauthenticated attacker with network access via multiple protocols allows to compromise Java SE.
- Record
SUSE-SU-2021:14640-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
java-1.8.0-ibmRed Hat:rhel_extras:7 From an advisory covering 5 CVEs |
before 1:1.8.0.6.25-1jpp.1.el7 | 1:1.8.0.6.25-1jpp.1.el7 |
java-1.8.0-ibm-demoRed Hat:rhel_extras:7 From an advisory covering 5 CVEs |
before 1:1.8.0.6.25-1jpp.1.el7 | 1:1.8.0.6.25-1jpp.1.el7 |
java-1.8.0-ibm-develRed Hat:rhel_extras:7 From an advisory covering 5 CVEs |
before 1:1.8.0.6.25-1jpp.1.el7 | 1:1.8.0.6.25-1jpp.1.el7 |
java-1.8.0-ibm-jdbcRed Hat:rhel_extras:7 From an advisory covering 5 CVEs |
before 1:1.8.0.6.25-1jpp.1.el7 | 1:1.8.0.6.25-1jpp.1.el7 |
java-1.8.0-ibm-pluginRed Hat:rhel_extras:7 From an advisory covering 5 CVEs |
before 1:1.8.0.6.25-1jpp.1.el7 | 1:1.8.0.6.25-1jpp.1.el7 |
java-1.8.0-ibm-srcRed Hat:rhel_extras:7 From an advisory covering 5 CVEs |
before 1:1.8.0.6.25-1jpp.1.el7 | 1:1.8.0.6.25-1jpp.1.el7 |
java-1.7.1-ibmRed Hat:rhel_extras:7 From an advisory covering 2 CVEs |
before 1:1.7.1.4.80-1jpp.1.el7 | 1:1.7.1.4.80-1jpp.1.el7 |
java-1.7.1-ibm-demoRed Hat:rhel_extras:7 From an advisory covering 2 CVEs |
before 1:1.7.1.4.80-1jpp.1.el7 | 1:1.7.1.4.80-1jpp.1.el7 |
java-1.7.1-ibm-develRed Hat:rhel_extras:7 From an advisory covering 2 CVEs |
before 1:1.7.1.4.80-1jpp.1.el7 | 1:1.7.1.4.80-1jpp.1.el7 |
java-1.7.1-ibm-jdbcRed Hat:rhel_extras:7 From an advisory covering 2 CVEs |
before 1:1.7.1.4.80-1jpp.1.el7 | 1:1.7.1.4.80-1jpp.1.el7 |
Show 56 moreShow less
| Package | Affected | Fixed |
|---|---|---|
java-1.7.1-ibm-pluginRed Hat:rhel_extras:7 From an advisory covering 2 CVEs |
before 1:1.7.1.4.80-1jpp.1.el7 | 1:1.7.1.4.80-1jpp.1.el7 |
java-1.7.1-ibm-srcRed Hat:rhel_extras:7 From an advisory covering 2 CVEs |
before 1:1.7.1.4.80-1jpp.1.el7 | 1:1.7.1.4.80-1jpp.1.el7 |
java-1.8.0-ibmRed Hat:enterprise_linux:8::supplementary From an advisory covering 5 CVEs |
before 1:1.8.0.6.25-2.el8_3 | 1:1.8.0.6.25-2.el8_3 |
java-1.8.0-ibm-demoRed Hat:enterprise_linux:8::supplementary From an advisory covering 5 CVEs |
before 1:1.8.0.6.25-2.el8_3 | 1:1.8.0.6.25-2.el8_3 |
java-1.8.0-ibm-develRed Hat:enterprise_linux:8::supplementary From an advisory covering 5 CVEs |
before 1:1.8.0.6.25-2.el8_3 | 1:1.8.0.6.25-2.el8_3 |
java-1.8.0-ibm-headlessRed Hat:enterprise_linux:8::supplementary From an advisory covering 5 CVEs |
before 1:1.8.0.6.25-2.el8_3 | 1:1.8.0.6.25-2.el8_3 |
java-1.8.0-ibm-jdbcRed Hat:enterprise_linux:8::supplementary From an advisory covering 5 CVEs |
before 1:1.8.0.6.25-2.el8_3 | 1:1.8.0.6.25-2.el8_3 |
java-1.8.0-ibm-pluginRed Hat:enterprise_linux:8::supplementary From an advisory covering 5 CVEs |
before 1:1.8.0.6.25-2.el8_3 | 1:1.8.0.6.25-2.el8_3 |
java-1.8.0-ibm-srcRed Hat:enterprise_linux:8::supplementary From an advisory covering 5 CVEs |
before 1:1.8.0.6.25-2.el8_3 | 1:1.8.0.6.25-2.el8_3 |
java-1.8.0-ibm-webstartRed Hat:enterprise_linux:8::supplementary From an advisory covering 5 CVEs |
before 1:1.8.0.6.25-2.el8_3 | 1:1.8.0.6.25-2.el8_3 |
java-1_7_1-ibmSUSE:HPE Helion OpenStack 8 From an advisory covering 2 CVEs |
before 1.7.1_sr4.80-38.62.1 | 1.7.1_sr4.80-38.62.1 |
java-1_7_1-ibmSUSE:OpenStack Cloud 7 From an advisory covering 2 CVEs |
before 1.7.1_sr4.80-38.62.1 | 1.7.1_sr4.80-38.62.1 |
java-1_7_1-ibmSUSE:OpenStack Cloud 8 From an advisory covering 2 CVEs |
before 1.7.1_sr4.80-38.62.1 | 1.7.1_sr4.80-38.62.1 |
java-1_7_1-ibmSUSE:OpenStack Cloud 9 From an advisory covering 2 CVEs |
before 1.7.1_sr4.80-38.62.1 | 1.7.1_sr4.80-38.62.1 |
java-1_7_1-ibmSUSE:OpenStack Cloud Crowbar 8 From an advisory covering 2 CVEs |
before 1.7.1_sr4.80-38.62.1 | 1.7.1_sr4.80-38.62.1 |
java-1_7_1-ibmSUSE:OpenStack Cloud Crowbar 9 From an advisory covering 2 CVEs |
before 1.7.1_sr4.80-38.62.1 | 1.7.1_sr4.80-38.62.1 |
java-1_7_1-ibmSUSE:Linux Enterprise Server for SAP Applications 12 SP2 From an advisory covering 2 CVEs |
before 1.7.1_sr4.80-38.62.1 | 1.7.1_sr4.80-38.62.1 |
java-1_7_1-ibmSUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 2 CVEs |
before 1.7.1_sr4.80-38.62.1 | 1.7.1_sr4.80-38.62.1 |
java-1_7_1-ibmSUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 2 CVEs |
before 1.7.1_sr4.80-38.62.1 | 1.7.1_sr4.80-38.62.1 |
java-1_7_1-ibmSUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 2 CVEs |
before 1.7.1_sr4.80-38.62.1 | 1.7.1_sr4.80-38.62.1 |
java-1_7_1-ibmSUSE:Linux Enterprise Server 12 SP2-LTSS From an advisory covering 2 CVEs |
before 1.7.1_sr4.80-38.62.1 | 1.7.1_sr4.80-38.62.1 |
java-1_7_1-ibmSUSE:Linux Enterprise Server 12 SP2-BCL From an advisory covering 2 CVEs |
before 1.7.1_sr4.80-38.62.1 | 1.7.1_sr4.80-38.62.1 |
java-1_7_1-ibmSUSE:Linux Enterprise Server 12 SP3-LTSS From an advisory covering 2 CVEs |
before 1.7.1_sr4.80-38.62.1 | 1.7.1_sr4.80-38.62.1 |
java-1_7_1-ibmSUSE:Linux Enterprise Server 12 SP3-BCL From an advisory covering 2 CVEs |
before 1.7.1_sr4.80-38.62.1 | 1.7.1_sr4.80-38.62.1 |
java-1_7_1-ibmSUSE:Linux Enterprise Server 12 SP4-LTSS From an advisory covering 2 CVEs |
before 1.7.1_sr4.80-38.62.1 | 1.7.1_sr4.80-38.62.1 |
java-1_7_1-ibmSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 2 CVEs |
before 1.7.1_sr4.80-38.62.1 | 1.7.1_sr4.80-38.62.1 |
java-1_7_1-ibmSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 2 CVEs |
before 1.7.1_sr4.80-38.62.1 | 1.7.1_sr4.80-38.62.1 |
java-1_8_0-ibmSUSE:HPE Helion OpenStack 8 From an advisory covering 2 CVEs |
before 1.8.0_sr6.25-30.81.1 | 1.8.0_sr6.25-30.81.1 |
java-1_8_0-ibmSUSE:OpenStack Cloud 7 From an advisory covering 2 CVEs |
before 1.8.0_sr6.25-30.81.1 | 1.8.0_sr6.25-30.81.1 |
java-1_8_0-ibmSUSE:OpenStack Cloud 8 From an advisory covering 2 CVEs |
before 1.8.0_sr6.25-30.81.1 | 1.8.0_sr6.25-30.81.1 |
java-1_8_0-ibmSUSE:OpenStack Cloud 9 From an advisory covering 2 CVEs |
before 1.8.0_sr6.25-30.81.1 | 1.8.0_sr6.25-30.81.1 |
java-1_8_0-ibmSUSE:OpenStack Cloud Crowbar 8 From an advisory covering 2 CVEs |
before 1.8.0_sr6.25-30.81.1 | 1.8.0_sr6.25-30.81.1 |
java-1_8_0-ibmSUSE:OpenStack Cloud Crowbar 9 From an advisory covering 2 CVEs |
before 1.8.0_sr6.25-30.81.1 | 1.8.0_sr6.25-30.81.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 12 SP2 From an advisory covering 2 CVEs |
before 1.8.0_sr6.25-30.81.1 | 1.8.0_sr6.25-30.81.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 2 CVEs |
before 1.8.0_sr6.25-30.81.1 | 1.8.0_sr6.25-30.81.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 2 CVEs |
before 1.8.0_sr6.25-30.81.1 | 1.8.0_sr6.25-30.81.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 2 CVEs |
before 1.8.0_sr6.25-30.81.1 | 1.8.0_sr6.25-30.81.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 12 SP2-LTSS From an advisory covering 2 CVEs |
before 1.8.0_sr6.25-30.81.1 | 1.8.0_sr6.25-30.81.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 12 SP2-BCL From an advisory covering 2 CVEs |
before 1.8.0_sr6.25-30.81.1 | 1.8.0_sr6.25-30.81.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 12 SP3-LTSS From an advisory covering 2 CVEs |
before 1.8.0_sr6.25-30.81.1 | 1.8.0_sr6.25-30.81.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 12 SP3-BCL From an advisory covering 2 CVEs |
before 1.8.0_sr6.25-30.81.1 | 1.8.0_sr6.25-30.81.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 12 SP4-LTSS From an advisory covering 2 CVEs |
before 1.8.0_sr6.25-30.81.1 | 1.8.0_sr6.25-30.81.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 2 CVEs |
before 1.8.0_sr6.25-30.81.1 | 1.8.0_sr6.25-30.81.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 2 CVEs |
before 1.8.0_sr6.25-30.81.1 | 1.8.0_sr6.25-30.81.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Module for Legacy 15 SP2 From an advisory covering 2 CVEs |
before 1.8.0_sr6.25-3.50.1 | 1.8.0_sr6.25-3.50.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 15-LTSS From an advisory covering 2 CVEs |
before 1.8.0_sr6.25-3.50.1 | 1.8.0_sr6.25-3.50.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 15 SP1-BCL From an advisory covering 2 CVEs |
before 1.8.0_sr6.25-3.50.1 | 1.8.0_sr6.25-3.50.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 15 SP1-LTSS From an advisory covering 2 CVEs |
before 1.8.0_sr6.25-3.50.1 | 1.8.0_sr6.25-3.50.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 15 From an advisory covering 2 CVEs |
before 1.8.0_sr6.25-3.50.1 | 1.8.0_sr6.25-3.50.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 15 SP1 From an advisory covering 2 CVEs |
before 1.8.0_sr6.25-3.50.1 | 1.8.0_sr6.25-3.50.1 |
java-1_8_0-ibmSUSE:Manager Proxy 4.0 From an advisory covering 2 CVEs |
before 1.8.0_sr6.25-3.50.1 | 1.8.0_sr6.25-3.50.1 |
java-1_8_0-ibmSUSE:Manager Retail Branch Server 4.0 From an advisory covering 2 CVEs |
before 1.8.0_sr6.25-3.50.1 | 1.8.0_sr6.25-3.50.1 |
java-1_8_0-ibmSUSE:Manager Server 4.0 From an advisory covering 2 CVEs |
before 1.8.0_sr6.25-3.50.1 | 1.8.0_sr6.25-3.50.1 |
java-1_8_0-ibmSUSE:Enterprise Storage 6 From an advisory covering 2 CVEs |
before 1.8.0_sr6.25-3.50.1 | 1.8.0_sr6.25-3.50.1 |
java-1_7_1-ibmSUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 2 CVEs |
before 1.7.1_sr4.80-26.65.1 | 1.7.1_sr4.80-26.65.1 |
java-1_7_0-ibmSUSE:Linux Enterprise Point of Sale 11 SP3 From an advisory covering 2 CVEs |
before 1.7.0_sr10.80-65.60.1 | 1.7.0_sr10.80-65.60.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-27221 is a critical vulnerability (CVSS 9.8) in Eclipse Openj9, published January 21, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.55%, the 75th percentile. No source names a fixed version.
References
bugs.eclipse.org/bugs/show_bug.cgi?id=569763
nvd.nist.gov/vuln/detail/CVE-2020-27221
github.com/advisories/GHSA-768g-gf3v-34vm
access.redhat.com/errata/RHSA-2021:0717
bugzilla.redhat.com/show_bug.cgi?id=1823224
Show 33 moreShow less
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0717.json
cve.org/CVERecord?id=CVE-2020-2773
suse.com/support/update/announcement/2021/suse-su-20210512-1
bugzilla.suse.com/1181239
ubuntu.com/security/CVE-2020-27221