CVE-2026-97400

CVSS 6.8 (medium) · published 2026-10-20

In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an arbitrary local file named inside the bundle and send its contents to an arbitrary remote host.

Weakness: CWE-611, CWE-618

Source: NVD CVE-2026-97400

References

• https://github.com/eclipse-openj9/openj9/pull/25003
• https://gitlab.eclipse.org/security/cve-assignment/-/work_items/324
• https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/949

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.