Eclipse OpenJ9 might return an incorrect value in JNI function GetStringUTFLength
Priority LOW 24CWE-190Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
In Eclipse OpenJ9 versions up to 0.47, the JNI function GetStringUTFLength may return an incorrect value which has wrapped around. From 0.48 the value is correct but may be truncated to include a smaller number of characters.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00414 35th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Eclipse Foundation | Open J9 | 0.8.0 – 0.47.0 | — | No fix listed | CNA |
- Open J9 VendorEclipse Foundation Affected 0.8.0 – 0.47.0 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eclipse:openj9:*:*:*:*:*:*:*:* | 0.8.0 to before 0.48.0 | Vulnerable | Eclipse Foundation |
- cpe:2.3:a:eclipse:openj9:*:*:*:*:*:*:*:* Versions 0.8.0 to before 0.48.0 Vulnerable ·Eclipse Foundation
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-10917
- 2026-10-03 Alias added: GHSA-492j-gvpg-m7v2
References
More Eclipse Foundation Openj9 vulnerabilities
- TI-2026-06062 Out-of-bounds read in Eclipse OpenJ9 CVSS 4.0HIGH 8.7
- TI-2021-09396 Missing initialization of resource in Eclipse OpenJ9 CVSS 3.1MEDIUM 6.5
- TI-2018-09008 Improper input validation in Eclipse OpenJ9 CVSS 3.0CRITICAL 9.8
- TI-2018-09006 Improper input validation in Eclipse OpenJ9 CVSS 3.0CRITICAL 9.8
- TI-2021-17899 In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for… CVSS 3.1CRITICAL 9.8
- TI-2019-08829 Out-of-bounds write in Eclipse OpenJ9 CVSS 3.0CRITICAL 9.8
Sources
- CVE-2024-10917 · CVE Program
- CVE-2024-10917 · NVD
- FIRST EPSS
- GHSA-492j-gvpg-m7v2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences