Vulnerability Description
In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an arbitrary local file named inside the bundle and send its contents to an arbitrary remote host.
Related Weaknesses (CWE)
References
- https://github.com/eclipse-openj9/openj9/pull/25003
- https://gitlab.eclipse.org/security/cve-assignment/-/work_items/324
- https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/949
FAQ
What is CVE-2026-97400?
CVE-2026-97400 is a documented vulnerability. In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an arbitrary local file named ...
How severe is CVE-2026-97400?
CVSS scoring is not yet available for CVE-2026-97400. Check NVD for updates.
Is there a patch for CVE-2026-97400?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.