CVE-2026-6918

This flaw lets someone send a specially made network message that stops the JITServer service before they need to sign in. It is like someone being able to jam a business phone system with one malformed call: they do not get access to conversations, but they can prevent the service from working.

This matters to you if you run Eclipse OpenJ9 with its JITServer feature enabled. It is only a risk if JITServer accepts TCP connections that an attacker can reach.

An attacker who can reach JITServer can send a crafted network message and make it crash. There is no record of active exploitation or publicly available exploit code, so this is an amber priority: upgrade promptly and limit network access while scheduling the change.

Confirm whether JITServer is installed, enabled, and listening for TCP connections, then identify the running Eclipse OpenJ9 version. Versions 0.21 through 0.58 are affected; upgrade to 0.59 or later, following your normal JVM runtime validation process because a runtime upgrade can require application compatibility testing. If patching must wait, isolate the JITServer listener with firewall rules or network segmentation so only known JVM clients can connect. No CISA KEV remediation due date applies because this CVE is not listed in KEV. Monitor JITServer and host logs for crashes, restarts, and unexpected connection attempts until the upgrade is complete.

CVSS 3.1 score: 7.5 High (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The issue is a pre-authentication remote denial of service against JITServer through a crafted 32-byte TCP message, associated with CWE-125 and CWE-1286. It is not listed in CISA KEV and no public exploit code is on record. EPSS is 0.5% (43rd percentile) with a flat trend; this is predictive rather than evidence of exploitation.