Access control flaw in Eclipse OpenJ9
Priority LOW 34CWE-264Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-264.
Summary
AIX builds of Eclipse OpenJ9 before 0.15.0 contain unused RPATHs which may facilitate code injection and privilege elevation by local users.
Why it matters now
EPSS 0.00394 33rd percentileScored 2026-11-07
Fix Fixed Eclipse OpenJ9 (The Eclipse Foundation): 0.15.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Eclipse Foundation | Eclipse OpenJ9 | before 0.15.0 | 0.15.0 | Patch available | CNA |
- Eclipse OpenJ9 VendorEclipse Foundation Affected before 0.15.0 Fixed in 0.15.0 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eclipse:openj9:*:*:*:*:*:*:*:* | before 0.15.0 | Vulnerable | Eclipse Foundation |
- cpe:2.3:a:eclipse:openj9:*:*:*:*:*:*:*:* Versions before 0.15.0 Vulnerable ·Eclipse Foundation
Remediation
- Fix · CNA Eclipse OpenJ9 (The Eclipse Foundation) Fixed in 0.15.0
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
The Eclipse Foundation Eclipse OpenJ9 0.15.0
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2019-08829 Out-of-bounds write in Eclipse OpenJ9Priority MEDIUM 46
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 4 products
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Satellite 5
Timeline
- 2026-10-02 Threatist record created from CVE-2019-11771
- 2026-10-03 Alias added: GHSA-3xjc-j52c-cpx8
References
More Eclipse Foundation Openj9 vulnerabilities
- TI-2026-06062 Out-of-bounds read in Eclipse OpenJ9 CVSS 4.0HIGH 8.7
- TI-2021-09396 Missing initialization of resource in Eclipse OpenJ9 CVSS 3.1MEDIUM 6.5
- TI-2018-09008 Improper input validation in Eclipse OpenJ9 CVSS 3.0CRITICAL 9.8
- TI-2018-09006 Improper input validation in Eclipse OpenJ9 CVSS 3.0CRITICAL 9.8
- TI-2021-17899 In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for… CVSS 3.1CRITICAL 9.8
- TI-2019-08829 Out-of-bounds write in Eclipse OpenJ9 CVSS 3.0CRITICAL 9.8
Sources
- CVE-2019-11771 · CVE Program
- CVE-2019-11771 · NVD
- FIRST EPSS
- GHSA-3xjc-j52c-cpx8 · GitHub Advisory Database · CC BY 4.0
- CVE-2019-11771 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences