Read the docs
TI-2019-07560 Aliases CVE-2019-10245GHSA-jq73-mhwg-56vq

Improper input validation in Eclipse OpenJ9

Priority LOW 38CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-119 and the CVSS impact.

Summary

In Eclipse OpenJ9 prior to the 0.14.0 release, the Java bytecode verifier incorrectly allows a method to execute past the end of bytecode array causing crashes. Eclipse OpenJ9 v0.14.0 correctly detects this case and rejects the attempted class load.

Why it matters now

EPSS 0.02492 84th percentileScored 2026-11-07
Fix Fixed Eclipse OpenJ9 (The Eclipse Foundation): 0.14.0Red Hat: 6 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eclipse FoundationEclipse OpenJ9before 0.14.00.14.0Patch availableCNA
  • Eclipse OpenJ9 VendorEclipse Foundation Affected before 0.14.0 Fixed in 0.14.0 Patch available CNA

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:a:eclipse:openj9:*:*:*:*:*:*:*:*before 0.14.0VulnerableEclipse Foundation
cpe:2.3:a:redhat:satellite:5.8:*:*:*:*:*:*:*5.8VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
  • cpe:2.3:a:eclipse:openj9:*:*:*:*:*:*:*:* Versions before 0.14.0 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:redhat:satellite:5.8:*:*:*:*:*:*:* Versions 5.8 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat

Remediation

  • Fix · CNA Eclipse OpenJ9 (The Eclipse Foundation) Fixed in 0.14.0

Red Hat 6 advisories

  • RHSA-2019:1325 Released 2019-06-04 · Red Hat rating Important
    java-1.8.0-ibm security update
    • Red Hat Satellite 5.8 (RHEL v.6) java-1.8.0-ibm-1:1.8.0.5.35-1jpp.1.el6_10, java-1.8.0-ibm-devel-1:1.8.0.5.35-1jpp.1.el6_10
  • RHSA-2019:1238 Released 2019-05-16 · Red Hat rating Critical
    java-1.8.0-ibm security update
    • Red Hat Enterprise Linux 8 Supplementary java-1.8.0-ibm-1:1.8.0.5.35-3.el8_0, java-1.8.0-ibm-demo-1:1.8.0.5.35-3.el8_0, java-1.8.0-ibm-devel-1:1.8.0.5.35-3.el8_0 +5
  • RHSA-2019:1165 Released 2019-05-13 · Red Hat rating Important
    java-1.7.1-ibm security update
    • Red Hat Enterprise Linux Desktop Supplementary (v. 6) java-1.7.1-ibm-1:1.7.1.4.45-1jpp.1.el6_10, java-1.7.1-ibm-demo-1:1.7.1.4.45-1jpp.1.el6_10, java-1.7.1-ibm-devel-1:1.7.1.4.45-1jpp.1.el6_10 +3
    • Red Hat Enterprise Linux HPC Node Supplementary (v. 6) java-1.7.1-ibm-1:1.7.1.4.45-1jpp.1.el6_10, java-1.7.1-ibm-demo-1:1.7.1.4.45-1jpp.1.el6_10, java-1.7.1-ibm-devel-1:1.7.1.4.45-1jpp.1.el6_10 +1
    • Red Hat Enterprise Linux Server Supplementary (v. 6) java-1.7.1-ibm-1:1.7.1.4.45-1jpp.1.el6_10, java-1.7.1-ibm-demo-1:1.7.1.4.45-1jpp.1.el6_10, java-1.7.1-ibm-devel-1:1.7.1.4.45-1jpp.1.el6_10 +3
    • Red Hat Enterprise Linux Workstation Supplementary (v. 6) java-1.7.1-ibm-1:1.7.1.4.45-1jpp.1.el6_10, java-1.7.1-ibm-demo-1:1.7.1.4.45-1jpp.1.el6_10, java-1.7.1-ibm-devel-1:1.7.1.4.45-1jpp.1.el6_10 +3
Show 3 more Red Hat advisories
  • RHSA-2019:1166 Released 2019-05-13 · Red Hat rating Important
    java-1.7.1-ibm security update
    • Red Hat Enterprise Linux Client Supplementary (v. 7) java-1.7.1-ibm-1:1.7.1.4.45-1jpp.1.el7, java-1.7.1-ibm-demo-1:1.7.1.4.45-1jpp.1.el7, java-1.7.1-ibm-devel-1:1.7.1.4.45-1jpp.1.el7 +3
    • Red Hat Enterprise Linux ComputeNode Supplementary (v. 7) java-1.7.1-ibm-1:1.7.1.4.45-1jpp.1.el7, java-1.7.1-ibm-demo-1:1.7.1.4.45-1jpp.1.el7, java-1.7.1-ibm-devel-1:1.7.1.4.45-1jpp.1.el7 +1
    • Red Hat Enterprise Linux Server Supplementary (v. 7) java-1.7.1-ibm-1:1.7.1.4.45-1jpp.1.el7, java-1.7.1-ibm-demo-1:1.7.1.4.45-1jpp.1.el7, java-1.7.1-ibm-devel-1:1.7.1.4.45-1jpp.1.el7 +3
    • Red Hat Enterprise Linux Workstation Supplementary (v. 7) java-1.7.1-ibm-1:1.7.1.4.45-1jpp.1.el7, java-1.7.1-ibm-demo-1:1.7.1.4.45-1jpp.1.el7, java-1.7.1-ibm-devel-1:1.7.1.4.45-1jpp.1.el7 +3
  • RHSA-2019:1163 Released 2019-05-13 · Red Hat rating Important
    java-1.8.0-ibm security update
    • Red Hat Enterprise Linux Desktop Supplementary (v. 6) java-1.8.0-ibm-1:1.8.0.5.35-1jpp.1.el6_10, java-1.8.0-ibm-demo-1:1.8.0.5.35-1jpp.1.el6_10, java-1.8.0-ibm-devel-1:1.8.0.5.35-1jpp.1.el6_10 +3
    • Red Hat Enterprise Linux HPC Node Supplementary (v. 6) java-1.8.0-ibm-1:1.8.0.5.35-1jpp.1.el6_10, java-1.8.0-ibm-demo-1:1.8.0.5.35-1jpp.1.el6_10, java-1.8.0-ibm-devel-1:1.8.0.5.35-1jpp.1.el6_10 +1
    • Red Hat Enterprise Linux Server Supplementary (v. 6) java-1.8.0-ibm-1:1.8.0.5.35-1jpp.1.el6_10, java-1.8.0-ibm-demo-1:1.8.0.5.35-1jpp.1.el6_10, java-1.8.0-ibm-devel-1:1.8.0.5.35-1jpp.1.el6_10 +3
    • Red Hat Enterprise Linux Workstation Supplementary (v. 6) java-1.8.0-ibm-1:1.8.0.5.35-1jpp.1.el6_10, java-1.8.0-ibm-demo-1:1.8.0.5.35-1jpp.1.el6_10, java-1.8.0-ibm-devel-1:1.8.0.5.35-1jpp.1.el6_10 +3
  • RHSA-2019:1164 Released 2019-05-13 · Red Hat rating Important
    java-1.8.0-ibm security update
    • Red Hat Enterprise Linux Client Supplementary (v. 7) java-1.8.0-ibm-1:1.8.0.5.35-1jpp.1.el7, java-1.8.0-ibm-demo-1:1.8.0.5.35-1jpp.1.el7, java-1.8.0-ibm-devel-1:1.8.0.5.35-1jpp.1.el7 +3
    • Red Hat Enterprise Linux ComputeNode Supplementary (v. 7) java-1.8.0-ibm-1:1.8.0.5.35-1jpp.1.el7, java-1.8.0-ibm-demo-1:1.8.0.5.35-1jpp.1.el7, java-1.8.0-ibm-devel-1:1.8.0.5.35-1jpp.1.el7 +1
    • Red Hat Enterprise Linux Server Supplementary (v. 7) java-1.8.0-ibm-1:1.8.0.5.35-1jpp.1.el7, java-1.8.0-ibm-demo-1:1.8.0.5.35-1jpp.1.el7, java-1.8.0-ibm-devel-1:1.8.0.5.35-1jpp.1.el7 +3
    • Red Hat Enterprise Linux Workstation Supplementary (v. 7) java-1.8.0-ibm-1:1.8.0.5.35-1jpp.1.el7, java-1.8.0-ibm-demo-1:1.8.0.5.35-1jpp.1.el7, java-1.8.0-ibm-devel-1:1.8.0.5.35-1jpp.1.el7 +3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 8 SupplementaryFixed RHSA-2019:1238
Red Hat Enterprise Linux Client Supplementary (v. 7)Fixed RHSA-2019:1164, RHSA-2019:1166
Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)Fixed RHSA-2019:1164, RHSA-2019:1166
Red Hat Enterprise Linux Desktop Supplementary (v. 6)Fixed RHSA-2019:1163, RHSA-2019:1165
Red Hat Enterprise Linux HPC Node Supplementary (v. 6)Fixed RHSA-2019:1163, RHSA-2019:1165
Red Hat Enterprise Linux Server Supplementary (v. 6)Fixed RHSA-2019:1163, RHSA-2019:1165
Red Hat Enterprise Linux Server Supplementary (v. 7)Fixed RHSA-2019:1164, RHSA-2019:1166
Red Hat Enterprise Linux Workstation Supplementary (v. 6)Fixed RHSA-2019:1163, RHSA-2019:1165
Red Hat Enterprise Linux Workstation Supplementary (v. 7)Fixed RHSA-2019:1164, RHSA-2019:1166
Red Hat Satellite 5.8 (RHEL v.6)Fixed RHSA-2019:1325

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-10245
  2. 2026-10-03 Alias added: GHSA-jq73-mhwg-56vq

References

Patch 1

Advisory 6

  • TI-2026-06062 Out-of-bounds read in Eclipse OpenJ9 CVSS 4.0HIGH 8.7
  • TI-2021-09396 Missing initialization of resource in Eclipse OpenJ9 CVSS 3.1MEDIUM 6.5
  • TI-2018-09008 Improper input validation in Eclipse OpenJ9 CVSS 3.0CRITICAL 9.8
  • TI-2018-09006 Improper input validation in Eclipse OpenJ9 CVSS 3.0CRITICAL 9.8
  • TI-2021-17899 In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for… CVSS 3.1CRITICAL 9.8
  • TI-2019-08829 Out-of-bounds write in Eclipse OpenJ9 CVSS 3.0CRITICAL 9.8
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences