CVE-2026-6918

Red Hat Security Advisory: java-21-ibm-semeru-certified-jdk security update

8.7 HighFix available

CVE-2026-6918 is a high vulnerability (CVSS 8.7) in Eclipse Openj9, published May 5, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.52%, the 44th percentile. Fixed in java-21-ibm-semeru-certified-jdk 1:21.0.11.0.10-1.el10_0.

In Eclipse Open9J versions 0.21 to 0.58, a pre-authentication remote attacker can crash JITServer by sending a 32-byte crafted TCP message.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.52%Up 0.5 points since May 6, 2026

What each source reports

CVE List Score used 8.7

In Eclipse Open9J versions 0.21 to 0.58, a pre-authentication remote attacker can crash JITServer by sending a 32-byte crafted TCP message.

Record: CVE-2026-6918
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-125, CWE-1286
Updated: 2026-11-02

EUVDEUVD-2026-27315 8.7

In Eclipse Open9J versions 0.21 to 0.58, a pre-authentication remote attacker can crash JITServer by sending a 32-byte crafted TCP message.

Record: EUVD-2026-27315
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-02

NVD 8.7

In Eclipse Open9J versions 0.21 to 0.58, a pre-authentication remote attacker can crash JITServer by sending a 32-byte crafted TCP message.

Record: CVE-2026-6918
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-125, CWE-1286
Updated: 2026-11-02

OSV 8.7

In Eclipse Open9J versions 0.21 to 0.58, a pre-authentication remote attacker can crash JITServer by sending a 32-byte crafted TCP message.

Record: CVE-2026-6918
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness: CWE-125
Updated: 2026-11-02

OSVRHSA-2026:22328 7.5

Red Hat Security Advisory: java-21-ibm-semeru-certified-jdk security update

Record: RHSA-2026:22328
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-6918 8.7

In Eclipse Open9J versions 0.21 to 0.58, a pre-authentication remote attacker can crash JITServer by sending a 32-byte crafted TCP message.

Record: UBUNTU-CVE-2026-6918
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`java-21-ibm-semeru-certified-jdk` Red Hat:enterprise_linux_eus:10.0	before 1:21.0.11.0.10-1.el10_0	1:21.0.11.0.10-1.el10_0
`java-21-ibm-semeru-certified-jdk-headless` Red Hat:enterprise_linux_eus:10.0	before 1:21.0.11.0.10-1.el10_0	1:21.0.11.0.10-1.el10_0
`java-21-ibm-semeru-certified-jdk` Red Hat:enterprise_linux_eus:10.2	before 1:21.0.11.0.10-2.el10_1	1:21.0.11.0.10-2.el10_1
`java-21-ibm-semeru-certified-jdk-devel` Red Hat:enterprise_linux_eus:10.2	before 1:21.0.11.0.10-2.el10_1	1:21.0.11.0.10-2.el10_1
`java-21-ibm-semeru-certified-jdk-headless` Red Hat:enterprise_linux_eus:10.2	before 1:21.0.11.0.10-2.el10_1	1:21.0.11.0.10-2.el10_1
`java-21-ibm-semeru-certified-jdk-jmods` Red Hat:enterprise_linux_eus:10.2	before 1:21.0.11.0.10-2.el10_1	1:21.0.11.0.10-2.el10_1
`java-21-ibm-semeru-certified-jdk-src` Red Hat:enterprise_linux_eus:10.2	before 1:21.0.11.0.10-2.el10_1	1:21.0.11.0.10-2.el10_1
`java-21-ibm-semeru-certified-jdk` Red Hat:enterprise_linux:10.2	before 1:21.0.11.0.10-2.el10_1	1:21.0.11.0.10-2.el10_1
`java-21-ibm-semeru-certified-jdk-devel` Red Hat:enterprise_linux:10.2	before 1:21.0.11.0.10-2.el10_1	1:21.0.11.0.10-2.el10_1
`java-21-ibm-semeru-certified-jdk-headless` Red Hat:enterprise_linux:10.2	before 1:21.0.11.0.10-2.el10_1	1:21.0.11.0.10-2.el10_1

Show 4 moreShow less

Affected packages
Package	Affected	Fixed
`java-21-ibm-semeru-certified-jdk-jmods` Red Hat:enterprise_linux:10.2	before 1:21.0.11.0.10-2.el10_1	1:21.0.11.0.10-2.el10_1
`java-21-ibm-semeru-certified-jdk-src` Red Hat:enterprise_linux:10.2	before 1:21.0.11.0.10-2.el10_1	1:21.0.11.0.10-2.el10_1
`eclipse` Ubuntu:16.04:LTS	All versions, plus listed versions 3.8.1-8	None known
`eclipse` Ubuntu:18.04:LTS	All versions, plus listed versions 3.8.1-103.8.1-11	None known

History

History
When	Changed	Sources
2026-11-02	created	CVE List, EUVD, NVD, OSV

References

Show 38 moreShow less