CVE-2024-10917
Eclipse OpenJ9 might return an incorrect value in JNI function GetStringUTFLength
In Eclipse OpenJ9 versions up to 0.47, the JNI function GetStringUTFLength may return an incorrect value which has wrapped around. From 0.48 the value is correct but may be truncated to include a smaller number of characters.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Eclipse OpenJ9 might return an incorrect value in JNI function GetStringUTFLength
In Eclipse OpenJ9 versions up to 0.47, the JNI function GetStringUTFLength may return an incorrect value which has wrapped around. From 0.48 the value is correct but may be truncated to include a smaller number of characters.
- Record
CVE-2024-10917- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-190
- Updated
- 2026-11-02
EUVDEUVD-2024-33347
In Eclipse OpenJ9 versions up to 0.47, the JNI function GetStringUTFLength may return an incorrect value which has wrapped around. From 0.48 the value is correct but may be truncated to include a smaller number of characters.
- Record
EUVD-2024-33347- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-492j-gvpg-m7v2
In Eclipse OpenJ9 versions up to 0.47, the JNI function GetStringUTFLength may return an...
In Eclipse OpenJ9 versions up to 0.47, the JNI function GetStringUTFLength may return an incorrect value which has wrapped around. From 0.48 the value is correct but may be truncated to include a smaller number of characters.
- Record
GHSA-492j-gvpg-m7v2- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-190
- Updated
- 2026-11-02
NVD
In Eclipse OpenJ9 versions up to 0.47, the JNI function GetStringUTFLength may return an incorrect value which has wrapped around. From 0.48 the value is correct but may be truncated to include a smaller number of characters.
- Record
CVE-2024-10917- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-190
- Updated
- 2026-11-02
OSV
Eclipse OpenJ9 might return an incorrect value in JNI function GetStringUTFLength
In Eclipse OpenJ9 versions up to 0.47, the JNI function GetStringUTFLength may return an incorrect value which has wrapped around. From 0.48 the value is correct but may be truncated to include a smaller number of characters.
- Record
CVE-2024-10917- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-190
- Updated
- 2026-11-02
OSVSUSE-SU-2025:0674-1 No score
Security update for java-1_8_0-ibm
This update for java-1_8_0-ibm fixes the following issues:
Update to Java 8.0 Service Refresh 8 Fix Pack 40 (bsc#1236470):
- CVE-2025-21502: unauthenticated attacker can obtain unauthorized read and write access to data through the Hotspot component API (bsc#1236278).
- Record
SUSE-SU-2025:0674-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:0675-1 No score
Security update for java-1_8_0-ibm
This update for java-1_8_0-ibm fixes the following issues:
Update to Java 8.0 Service Refresh 8 Fix Pack 40 (bsc#1236470):
- CVE-2025-21502: unauthenticated attacker can obtain unauthorized read and write access to data through the Hotspot component API (bsc#1236278).
- Record
SUSE-SU-2025:0675-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
java-1_8_0-ibmSUSE:Linux Enterprise Module for Legacy 15 SP6 From an advisory covering 2 CVEs |
before 1.8.0_sr8.40-150000.3.98.1 | 1.8.0_sr8.40-150000.3.98.1 |
java-1_8_0-ibmSUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS From an advisory covering 2 CVEs |
before 1.8.0_sr8.40-150000.3.98.1 | 1.8.0_sr8.40-150000.3.98.1 |
java-1_8_0-ibmSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 2 CVEs |
before 1.8.0_sr8.40-150000.3.98.1 | 1.8.0_sr8.40-150000.3.98.1 |
java-1_8_0-ibmSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 2 CVEs |
before 1.8.0_sr8.40-150000.3.98.1 | 1.8.0_sr8.40-150000.3.98.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 15 SP3-LTSS From an advisory covering 2 CVEs |
before 1.8.0_sr8.40-150000.3.98.1 | 1.8.0_sr8.40-150000.3.98.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 2 CVEs |
before 1.8.0_sr8.40-150000.3.98.1 | 1.8.0_sr8.40-150000.3.98.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 2 CVEs |
before 1.8.0_sr8.40-150000.3.98.1 | 1.8.0_sr8.40-150000.3.98.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 15 SP3 From an advisory covering 2 CVEs |
before 1.8.0_sr8.40-150000.3.98.1 | 1.8.0_sr8.40-150000.3.98.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 2 CVEs |
before 1.8.0_sr8.40-150000.3.98.1 | 1.8.0_sr8.40-150000.3.98.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 2 CVEs |
before 1.8.0_sr8.40-150000.3.98.1 | 1.8.0_sr8.40-150000.3.98.1 |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
java-1_8_0-ibmSUSE:Enterprise Storage 7.1 From an advisory covering 2 CVEs |
before 1.8.0_sr8.40-150000.3.98.1 | 1.8.0_sr8.40-150000.3.98.1 |
java-1_8_0-ibmopenSUSE:Leap 15.6 From an advisory covering 2 CVEs |
before 1.8.0_sr8.40-150000.3.98.1 | 1.8.0_sr8.40-150000.3.98.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 12 SP5-LTSS From an advisory covering 2 CVEs |
before 1.8.0_sr8.40-30.132.1 | 1.8.0_sr8.40-30.132.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 From an advisory covering 2 CVEs |
before 1.8.0_sr8.40-30.132.1 | 1.8.0_sr8.40-30.132.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-10917 is a low vulnerability (CVSS 3.7) in Eclipse Openj9, published November 11, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. No source names a fixed version.
References
gitlab.eclipse.org/security/cve-assignement/-/issues/47
github.com/eclipse-openj9/openj9/pull/20362
nvd.nist.gov/vuln/detail/CVE-2024-10917