TI-2026-76842 Aliases CVE-2026-97400 GHSA-548h-r226-j3rq

XML external entity flaw in Eclipse OpenJ9 jdmpview reads local files

LOW 29CWE-611Published 2026-10-20 · Updated 2026-10-20

Key facts

Attack vector: Local
Privileges required: None
User interaction: Active
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: High · Low · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Eclipse OpenJ9 from 0.8.0 before 0.63 is affected through its jdmpview tool and equivalent DTFJ code. The XML parser resolves external entities without restriction (CWE-611), so a crafted diagnostic dump bundle can make the analyst's machine read a local file. If an analyst opens such a bundle, the file contents can be sent to an arbitrary remote host.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an arbitrary local file named inside the bundle and send its contents to an arbitrary remote host.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00164 5th percentileScored 2026-11-07

Fix Fixed Eclipse OpenJ9 (Eclipse Foundation): 0.63

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Eclipse Foundation	Eclipse OpenJ9	0.8.0 to before 0.63	0.63	Patch available	CNA

Eclipse OpenJ9 VendorEclipse Foundation Affected 0.8.0 to before 0.63 Fixed in 0.63 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:eclipse:openj9::::::::	—	—	Eclipse Foundation

cpe:2.3:a:eclipse:openj9:*:*:*:*:*:*:*:* Versions — — ·Eclipse Foundation

Remediation

Update Eclipse OpenJ9 to version 0.63, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA Eclipse OpenJ9 (Eclipse Foundation) Fixed in 0.63

Timeline

2026-10-20 Threatist record created from CVE-2026-97400
2026-10-20 Alias added: GHSA-548h-r226-j3rq

References

Other 3

TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
TI-2026-81947 Unauthenticated command injection in Eclipse Che che-machine-exec CVSS 3.1CRITICAL 9.8
TI-2026-13216 CWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSyx Go Components CVSS 3.1CRITICAL 9.8
TI-2026-06514 Path traversal in Eclipse BaSyx CVSS 3.1CRITICAL 10.0
TI-2026-01382 In the Eclipse Theia Website repository, the GitHub Actions workflow… CVSS 3.1CRITICAL 10.0
TI-2026-74697 Authentication bypass in Eclipse Jetty EthereumAuthenticator CVSS 4.0CRITICAL 9.3

See all 466 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences