CVE-2023-2597

In Eclipse Openj9 before version 0.38.0, in the implementation of the shared cache (which is...

7.0 High

In Eclipse Openj9 before version 0.38.0, in the implementation of the shared cache (which is enabled by default in OpenJ9 builds) the size of a string is not properly checked against the size of the buffer.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: High
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.42%Up 0.4 points since May 23, 2023

What each source reports

CVE List Score used 7.0

Record: CVE-2023-2597
CVSS 3.1: 7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-120
Updated: 2026-11-02

EUVDEUVD-2023-34071 7.0

Record: EUVD-2023-34071
CVSS 3.1: 7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-4794-756c-cx7v 7.0

In Eclipse Openj9 before version 0.38.0, in the implementation of the shared cache (which is...

Record: GHSA-4794-756c-cx7v
CVSS 3.1: 7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-120, CWE-125
Updated: 2026-11-02

NVD 7.0

Record: CVE-2023-2597
CVSS 3.1: 7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weakness: CWE-120, CWE-125
Updated: 2026-11-02

OSV 7.0

Record: CVE-2023-2597
CVSS 3.1: 7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-120
Updated: 2026-11-02

OSVopenSUSE-SU-2024:13110-1 No score

java-1_8_0-openj9-1.8.0.372-1.1 on GA media

These are all security issues fixed in the java-1_8_0-openj9-1.8.0.372-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:13110-1
Updated: 2026-11-02

Show 7 moreShow less

OSVopenSUSE-SU-2024:13130-1 No score

java-11-openj9-11.0.20.0-1.1 on GA media

These are all security issues fixed in the java-11-openj9-11.0.20.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:13130-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:13131-1 No score

java-17-openj9-17.0.8.0-1.1 on GA media

These are all security issues fixed in the java-17-openj9-17.0.8.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:13131-1
Updated: 2026-11-02

OSVopenSUSE-SU-2025:0066-1 No score

Security update for java-11-openj9

This update for java-11-openj9 fixes the following issues:

Update to OpenJDK 11.0.26 with OpenJ9 0.49.0 virtual machine
Including Oracle October 2024 and January 2025 CPU changes
- CVE-2024-21208 (boo#1231702), CVE-2024-21210 (boo#1231711), CVE-2024-21217 (boo#1231716), CVE-2024-21235 (boo#1231719), CVE-2025-21502 (boo#1236278)
- OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.49/
Update to OpenJDK 11.0.24 with OpenJ9 0.46.0 virtual machine
Including Oracle July 2024 CPU changes
- CVE-2024-21131 (boo#1228046), CVE-2024-21138 (boo#1228047), CVE-2024-21140 (boo#1228048), CVE-2024-21144 (boo#1228050), CVE-2024-21147 (boo#1228052), CVE-2024-21145 (boo#1228051)
- OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.46/
Update to OpenJDK 11.0.23 with OpenJ9 0.44.0 virtual machine
Including Oracle April 2024 CPU changes
- CVE-2024-21012 (boo#1222987), CVE-2024-21094 (boo#1222986), CVE-2024-21011 (boo#1222979), CVE-2024-21085 (boo#1222984), CVE-2024-21068 (boo#1222983)
Including OpenJ9/OMR specific fix:
- CVE-2024-3933 (boo#1225470)
- OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.44/
Update to OpenJDK 11.0.22 with OpenJ9 0.43.0 virtual machine
Including Oracle January 2024 CPU changes
- CVE-2024-20918 (boo#1218907), CVE-2024-20919 (boo#1218903), CVE-2024-20921 (boo#1218905), CVE-2024-20926 (boo#1218906), CVE-2024-20945 (boo#1218909), CVE-2024-20952 (boo#1218911)
- OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.43/
Remove the possibility to put back removes JavaEE modules, since our Java stack does not need this hack any more
Update to OpenJDK 11.0.21 with OpenJ9 0.41.0 virtual machine
Including Oracle October 2023 CPU changes
- CVE-2023-22081, boo#1216374
Including Openj9 0.41.0 fixes of CVE-2023-5676, boo#1217214
- For other OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.41
Update to OpenJDK 11.0.20.1 with OpenJ9 0.40.0 virtual machine
- JDK-8313765: Invalid CEN header (invalid zip64 extra data field size)
Update to OpenJDK 11.0.20 with OpenJ9 0.40.0 virtual machine
Including Oracle April 2023 CPU changes
- CVE-2023-22006 (boo#1213473), CVE-2023-22036 (boo#1213474), CVE-2023-22041 (boo#1213475), CVE-2023-22045 (boo#1213481), CVE-2023-22049 (boo#1213482), CVE-2023-25193 (boo#1207922)
- OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.40
Update to OpenJDK 11.0.19 with OpenJ9 0.38.0 virtual machine
Including Oracle April 2023 CPU changes
- CVE-2023-21930 (boo#1210628), CVE-2023-21937 (boo#1210631), CVE-2023-21938 (boo#1210632), CVE-2023-21939 (boo#1210634), CVE-2023-21954 (boo#1210635), CVE-2023-21967 (boo#1210636), CVE-2023-21968 (boo#1210637)
- OpenJ9 specific vulnerability: CVE-2023-2597 (boo#1211615)
- OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.38
Update to OpenJDK 11.0.18 with OpenJ9 0.36.1 virtual machine
- Including Oracle January 2023 CPU changes
  - CVE-2023-21835, boo#1207246
  - CVE-2023-21843, boo#1207248
- OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.36
Update to OpenJDK 11.0.17 with OpenJ9 0.35.0 virtual machine
- Including Oracle October 2022 CPU changes CVE-2022-21618 (boo#1204468), CVE-2022-21619 (boo#1204473), CVE-2022-21626 (boo#1204471), CVE-2022-21624 (boo#1204475), CVE-2022-21628 (boo#1204472), CVE-2022-39399 (boo#1204480)
- Fixes OpenJ9 vulnerability boo#1204703, CVE-2022-3676
- OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.35
Update to OpenJDK 11.0.16 with OpenJ9 0.33.0 virtual machine
- Including Oracle July 2022 CPU changes CVE-2022-21540 (boo#1201694), CVE-2022-21541 (boo#1201692), CVE-2022-34169 (boo#1201684)
- OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.33
Update to OpenJDK 11.0.15 with OpenJ9…

Record: openSUSE-SU-2025:0066-1
Updated: 2026-11-02

OSVopenSUSE-SU-2025:0067-1 No score

Security update for java-17-openj9

This update for java-17-openj9 fixes the following issues:

Update to OpenJDK 17.0.14 with OpenJ9 0.49.0 virtual machine
Including Oracle October 2024 and January 2025 CPU changes
- CVE-2024-21208 (boo#1231702), CVE-2024-21210 (boo#1231711), CVE-2024-21217 (boo#1231716), CVE-2024-21235 (boo#1231719), CVE-2025-21502 (boo#1236278)
- OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.49/
Update to OpenJDK 17.0.12 with OpenJ9 0.46.0 virtual machine
Including Oracle July 2024 CPU changes
- CVE-2024-21131 (boo#1228046), CVE-2024-21138 (boo#1228047), CVE-2024-21140 (boo#1228048), CVE-2024-21147 (boo#1228052), CVE-2024-21145 (boo#1228051)
- OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.46/
Update to OpenJDK 17.0.11 with OpenJ9 0.44.0 virtual machine
Including Oracle April 2024 CPU changes
- CVE-2024-21012 (boo#1222987), CVE-2024-21094 (boo#1222986), CVE-2024-21011 (boo#1222979), CVE-2024-21068 (boo#1222983)
- OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.44/
Update to OpenJDK 17.0.10 with OpenJ9 0.43.0 virtual machine
Including Oracle January 2024 CPU changes
- CVE-2024-20918 (boo#1218907), CVE-2024-20919 (boo#1218903), CVE-2024-20921 (boo#1218905), CVE-2024-20932 (boo#1218908), CVE-2024-20945 (boo#1218909), CVE-2024-20952 (boo#1218911)
- OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.43/
Update to OpenJDK 17.0.9 with OpenJ9 0.41.0 virtual machine
Including Oracle October 2023 CPU changes
- CVE-2023-22081, boo#1216374
- CVE-2023-22025, boo#1216339
Including Openj9 0.41.0 fixes of CVE-2023-5676, boo#1217214
- For other OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.41
Update to OpenJDK 17.0.8.1 with OpenJ9 0.40.0 virtual machine
- JDK-8313765: Invalid CEN header (invalid zip64 extra data field size)
Update to OpenJDK 17.0.8 with OpenJ9 0.40.0 virtual machine
Including Oracle July 2023 CPU changes
- CVE-2023-22006 (boo#1213473), CVE-2023-22036 (boo#1213474), CVE-2023-22041 (boo#1213475), CVE-2023-22044 (boo#1213479), CVE-2023-22045 (boo#1213481), CVE-2023-22049 (boo#1213482), CVE-2023-25193 (boo#1207922)
- OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.40
Update to OpenJDK 17.0.7 with OpenJ9 0.38.0 virtual machine
Including Oracle April 2023 CPU changes
- CVE-2023-21930 (boo#1210628), CVE-2023-21937 (boo#1210631), CVE-2023-21938 (boo#1210632), CVE-2023-21939 (boo#1210634), CVE-2023-21954 (boo#1210635), CVE-2023-21967 (boo#1210636), CVE-2023-21968 (boo#1210637)
- OpenJ9 specific vulnerability: CVE-2023-2597 (boo#1211615)
- OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.38
Update to OpenJDK 17.0.6 with OpenJ9 0.36.0 virtual machine
- including Oracle January 2023 CPU changes
  - CVE-2023-21835, boo#1207246
  - CVE-2023-21843, boo#1207248
- OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.36
Update to OpenJDK 17.0.5 with OpenJ9 0.35.0 virtual machine
- Including Oracle October 2022 CPU changes CVE-2022-21618 (boo#1204468), CVE-2022-21619 (boo#1204473), CVE-2022-21626 (boo#1204471), CVE-2022-21624 (boo#1204475), CVE-2022-21628 (boo#1204472), CVE-2022-39399 (boo#1204480)
- Fixes OpenJ9 vulnerability boo#1204703, CVE-2022-3676
- OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.35

Record: openSUSE-SU-2025:0067-1
Updated: 2026-11-02

OSVSUSE-SU-2023:2476-1 No score

Security update for java-1_8_0-ibm

This update for java-1_8_0-ibm fixes the following issues:

CVE-2023-21930: Fixed possible compromise from unauthenticated attacker with network access via TLS (bsc#1210628).
CVE-2023-21937: Fixed vulnerability inside the networking component (bsc#1210631).
CVE-2023-21938: Fixed vulnerability inside the library component (bsc#1210632).
CVE-2023-21939: Fixed vulnerability inside the swing component (bsc#1210634).
CVE-2023-21968: Fixed vulnerability inside the library component (bsc#1210637).
CVE-2023-2597: Fixed buffer overflow in shared cache implementation (bsc#1211615).
CVE-2023-21967: Fixed vulnerability inside the JSSE component (bsc#1210636).
CVE-2023-21954: Fixed vulnerability inside the hotspot component (bsc#1210635).

Additional reference fixed already in 8.0.7.15:

CVE-2023-30441: Fixed components that could have exposed sensitive information using a combination of flaws and configurations (bsc#1210711).

Record: SUSE-SU-2023:2476-1
Updated: 2026-11-02

OSVSUSE-SU-2023:2491-1 No score

Security update for java-1_8_0-ibm

This update for java-1_8_0-ibm fixes the following issues:

CVE-2023-21930: Fixed possible compromise from unauthenticated attacker with network access via TLS (bsc#1210628).
CVE-2023-21937: Fixed vulnerability inside the networking component (bsc#1210631).
CVE-2023-21938: Fixed vulnerability inside the library component (bsc#1210632).
CVE-2023-21939: Fixed vulnerability inside the swing component (bsc#1210634).
CVE-2023-21968: Fixed vulnerability inside the library component (bsc#1210637).
CVE-2023-2597: Fixed buffer overflow in shared cache implementation (bsc#1211615).
CVE-2023-21967: Fixed vulnerability inside the JSSE component (bsc#1210636).
CVE-2023-21954: Fixed vulnerability inside the hotspot component (bsc#1210635).

Additional reference fixed already in 8.0.7.15:

CVE-2023-30441: Fixed components that could have exposed sensitive information using a combination of flaws and configurations (bsc#1210711).

Record: SUSE-SU-2023:2491-1
Updated: 2026-11-02

OSVSUSE-SU-2023:3305-1 No score

Security update for java-1_8_0-openj9

This update for java-1_8_0-openj9 fixes the following issues:

Update to OpenJDK 8u372 build 07 with OpenJ9 0.38.0 virtual machine.

CVE-2023-21930: Unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition (bsc#1210628). CVE-2023-21937: Fixed vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). (bsc#1210631). CVE-2023-21938: Fixed vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). (bsc#1210632). CVE-2023-21939: Fixed vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing). (bsc#1210634). CVE-2023-21954: Fixed vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). (bsc#1210635). CVE-2023-21967: Fixed vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). (bsc#1210636). CVE-2023-21968: Fixed ulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries) (bsc#1210637). CVE-2023-2597: Fixed buffer overflow in shared cache implementation (bsc#1211615).

Record: SUSE-SU-2023:3305-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`java-1_8_0-ibm` SUSE:OpenStack Cloud 9 From an advisory covering 9 CVEs	before 1.8.0_sr8.5-30.108.1	1.8.0_sr8.5-30.108.1
`java-1_8_0-ibm` SUSE:OpenStack Cloud Crowbar 9 From an advisory covering 9 CVEs	before 1.8.0_sr8.5-30.108.1	1.8.0_sr8.5-30.108.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 9 CVEs	before 1.8.0_sr8.5-30.108.1	1.8.0_sr8.5-30.108.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 9 CVEs	before 1.8.0_sr8.5-30.108.1	1.8.0_sr8.5-30.108.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Server 12 SP2-BCL From an advisory covering 9 CVEs	before 1.8.0_sr8.5-30.108.1	1.8.0_sr8.5-30.108.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Server 12 SP4-ESPOS From an advisory covering 9 CVEs	before 1.8.0_sr8.5-30.108.1	1.8.0_sr8.5-30.108.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Server 12 SP4-LTSS From an advisory covering 9 CVEs	before 1.8.0_sr8.5-30.108.1	1.8.0_sr8.5-30.108.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Server 12 SP5 From an advisory covering 9 CVEs	before 1.8.0_sr8.5-30.108.1	1.8.0_sr8.5-30.108.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 9 CVEs	before 1.8.0_sr8.5-30.108.1	1.8.0_sr8.5-30.108.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Module for Legacy 15 SP4 From an advisory covering 9 CVEs	before 1.8.0_sr8.5-150000.3.74.1	1.8.0_sr8.5-150000.3.74.1

Show 23 moreShow less

Affected packages
Package	Affected	Fixed
`java-1_8_0-ibm` SUSE:Linux Enterprise Module for Legacy 15 SP5 From an advisory covering 9 CVEs	before 1.8.0_sr8.5-150000.3.74.1	1.8.0_sr8.5-150000.3.74.1
`java-1_8_0-ibm` SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS From an advisory covering 9 CVEs	before 1.8.0_sr8.5-150000.3.74.1	1.8.0_sr8.5-150000.3.74.1
`java-1_8_0-ibm` SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS From an advisory covering 9 CVEs	before 1.8.0_sr8.5-150000.3.74.1	1.8.0_sr8.5-150000.3.74.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Server 15 SP1-LTSS From an advisory covering 9 CVEs	before 1.8.0_sr8.5-150000.3.74.1	1.8.0_sr8.5-150000.3.74.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Server 15 SP2-LTSS From an advisory covering 9 CVEs	before 1.8.0_sr8.5-150000.3.74.1	1.8.0_sr8.5-150000.3.74.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Server 15 SP3-LTSS From an advisory covering 9 CVEs	before 1.8.0_sr8.5-150000.3.74.1	1.8.0_sr8.5-150000.3.74.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Server for SAP Applications 15 SP1 From an advisory covering 9 CVEs	before 1.8.0_sr8.5-150000.3.74.1	1.8.0_sr8.5-150000.3.74.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Server for SAP Applications 15 SP2 From an advisory covering 9 CVEs	before 1.8.0_sr8.5-150000.3.74.1	1.8.0_sr8.5-150000.3.74.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Server for SAP Applications 15 SP3 From an advisory covering 9 CVEs	before 1.8.0_sr8.5-150000.3.74.1	1.8.0_sr8.5-150000.3.74.1
`java-1_8_0-ibm` SUSE:Enterprise Storage 7 From an advisory covering 9 CVEs	before 1.8.0_sr8.5-150000.3.74.1	1.8.0_sr8.5-150000.3.74.1
`java-1_8_0-ibm` SUSE:Enterprise Storage 7.1 From an advisory covering 9 CVEs	before 1.8.0_sr8.5-150000.3.74.1	1.8.0_sr8.5-150000.3.74.1
`java-1_8_0-ibm` openSUSE:Leap 15.4 From an advisory covering 9 CVEs	before 1.8.0_sr8.5-150000.3.74.1	1.8.0_sr8.5-150000.3.74.1
`java-1_8_0-ibm` openSUSE:Leap 15.5 From an advisory covering 9 CVEs	before 1.8.0_sr8.5-150000.3.74.1	1.8.0_sr8.5-150000.3.74.1
`java-1_8_0-openj9` SUSE:Linux Enterprise Module for Package Hub 15 SP5 From an advisory covering 8 CVEs	before 1.8.0.372-150200.3.33.2	1.8.0.372-150200.3.33.2
`java-1_8_0-openj9` openSUSE:Leap 15.4 From an advisory covering 8 CVEs	before 1.8.0.372-150200.3.33.2	1.8.0.372-150200.3.33.2
`java-1_8_0-openj9` openSUSE:Leap 15.5 From an advisory covering 8 CVEs	before 1.8.0.372-150200.3.33.2	1.8.0.372-150200.3.33.2
`java-1_8_0-openj9` openSUSE:Tumbleweed From an advisory covering 5 CVEs	before 1.8.0.372-1.1	1.8.0.372-1.1
`java-11-openj9` openSUSE:Tumbleweed From an advisory covering 8 CVEs	before 11.0.20.0-1.1	11.0.20.0-1.1
`java-17-openj9` openSUSE:Tumbleweed From an advisory covering 9 CVEs	before 17.0.8.0-1.1	17.0.8.0-1.1
`java-11-openj9` SUSE:Package Hub 15 SP6 From an advisory covering 58 CVEs	before 11.0.26.0-bp156.4.3.1	11.0.26.0-bp156.4.3.1
`java-11-openj9` openSUSE:Leap 15.6 From an advisory covering 58 CVEs	before 11.0.26.0-bp156.4.3.1	11.0.26.0-bp156.4.3.1
`java-17-openj9` SUSE:Package Hub 15 SP6 From an advisory covering 47 CVEs	before 17.0.14.0-bp156.3.3.1	17.0.14.0-bp156.3.3.1
`java-17-openj9` openSUSE:Leap 15.6 From an advisory covering 47 CVEs	before 17.0.14.0-bp156.3.3.1	17.0.14.0-bp156.3.3.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-2597 is a high vulnerability (CVSS 7.0) in Eclipse Openj9, published May 22, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.42%, the 36th percentile. No source names a fixed version.

References

Show 162 moreShow less

This page doesn't list everything

Left out here: the rest of 1 source description. The JSON record has them.