Openj9
23 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Openj9, a product in the devtools ci space. Use it to gauge the current risk picture and drill into individual advisories.
Openj9 CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 1 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 1 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 1 |
| 2026-06 | 0 |
| 2026-07 | 2 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 23 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical9
- High7
- Medium6
- Low1
Latest CVEs
The 15 most recently published vulnerabilities affecting Openj9.
- CVE-2026-16441Eclipse OpenJ9 : Method resolution default method precedence failure9.6
- CVE-2026-16439Eclipse OpenJ9 : Using -Xtrace to trace method arguments can lead to buffer underflow9.1
- CVE-2026-6918In Eclipse Open9J versions 0.21 to 0.58, a pre-authentication remote attacker can crash JITServer by sending a 32-byte crafted TCP message.7.5
- CVE-2025-4447Buffer Overflow in Eclipse OpenJ97.8
- CVE-2024-10917Eclipse OpenJ9 might return an incorrect value in JNI function GetStringUTFLength3.7
- CVE-2024-3933Eclipse Open J9 With -Xgc:concurrentScavenge on IBM Z, could write/read outside of a buffer5.3
- CVE-2023-5676Eclipse OpenJ9 possible infinite busy hang4.1
- CVE-2023-2597In Eclipse Openj9 before version 0.38.0, in the implementation of the shared cache (which is enabled by default in OpenJ9 builds) the size of a string is not properly checked against the size of th...7.0
- CVE-2022-3676In Eclipse Openj9 before version 0.35.0, interface calls can be inlined without a runtime type check. Malicious bytecode could make use of this inlining to access or modify memory via an incompatib...6.5
- CVE-2021-41041In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during bytecode verification when verification is triggered by a MethodHandle invocation, allowing unverifi...5.3
- CVE-2021-41035In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methods.9.8
- CVE-2021-28167In Eclipse Openj9 to version 0.25.0, usage of the jdk.internal.reflect.ConstantPool API causes the JVM in some cases to pre-resolve certain constant pool entries. This allows a user to call static ...6.5
- CVE-2020-27221In Eclipse OpenJ9 up to and including version 0.23, there is potential for a stack-based buffer overflow when the virtual machine or JNI natives are converting from UTF-8 characters to platform enc...9.8
- CVE-2019-17639In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the System.arraycopy method with a length longer than the length of the source or destination array can, in certain specially cra...5.3
- CVE-2019-17631From Eclipse OpenJ9 0.15 to 0.16, access to diagnostic operations such as causing a GC or creating a diagnostic file are permitted without any privilege checks.9.1
Product grouping is registry-driven, with AI assist and human review. How it works