In Eclipse OMR versions up to 0.11, the arraycmp SIMD implementation for Z and P does not check if the number of bytes to compare is zero.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3614-1 advisory.

    Update to Java 8.0 Service Refresh 8 Fix Pack 70 (bsc#1273223).

    - CVE-2026-16243: inconsistent handling of zero length data in `arraycmp` of the SIMD evaluator     (bsc#1274275).
    - CVE-2026-16439: using `-Xtrace` to trace method arguments can lead to buffer underflow (bsc#1272250).
    - CVE-2026-16441: method resolution default method precedence failure (bsc#1272248).
    - CVE-2026-41254: lcms2: information disclosure or denial of service via integer overflow in `CubeSize`     (bsc#1272459).
    - CVE-2026-46968: unauthorized creation, deletion or modification access to critical data (bsc#1272224).
    - CVE-2026-47010: unauthorized update, insert or delete access to data (bsc#1272225).
    - CVE-2026-47021: partial denial of service via multiple network protocols (bsc#1272227).
    - CVE-2026-47027: partial denial of service via multiple network protocols (bsc#1272228).
    - CVE-2026-47057: hang or frequently repeatable crash via multiple network protocols (bsc#1272233).
    - CVE-2026-47058: unauthorized creation, deletion or modification access to critical data (bsc#1272234).
    - CVE-2026-47059: partial denial of service via multiple network protocols (bsc#1272235).
    - CVE-2026-47063: unauthorized creation, deletion or modification access to critical data (bsc#1272236).
    - CVE-2026-60147: unauthorized update, insert or delete access to data (bsc#1272237).
    - CVE-2026-8400:  malicious IIOP server can  induce loading and instantation of arbitrary classes     (bsc#1274276).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3615-1 advisory.

    Update to Java 8.0 Service Refresh 8 Fix Pack 70 (bsc#1273223).

    - CVE-2026-16243: inconsistent handling of zero length data in `arraycmp` of the SIMD evaluator     (bsc#1274275).
    - CVE-2026-16439: using `-Xtrace` to trace method arguments can lead to buffer underflow (bsc#1272250).
    - CVE-2026-16441: method resolution default method precedence failure (bsc#1272248).
    - CVE-2026-41254: lcms2: information disclosure or denial of service via integer overflow in `CubeSize`     (bsc#1272459).
    - CVE-2026-46968: unauthorized creation, deletion or modification access to critical data (bsc#1272224).
    - CVE-2026-47010: unauthorized update, insert or delete access to data (bsc#1272225).
    - CVE-2026-47021: partial denial of service via multiple network protocols (bsc#1272227).
    - CVE-2026-47027: partial denial of service via multiple network protocols (bsc#1272228).
    - CVE-2026-47057: hang or frequently repeatable crash via multiple network protocols (bsc#1272233).
    - CVE-2026-47058: unauthorized creation, deletion or modification access to critical data (bsc#1272234).
    - CVE-2026-47059: partial denial of service via multiple network protocols (bsc#1272235).
    - CVE-2026-47063: unauthorized creation, deletion or modification access to critical data (bsc#1272236).
    - CVE-2026-60147: unauthorized update, insert or delete access to data (bsc#1272237).
    - CVE-2026-8400:  malicious IIOP server can  induce loading and instantation of arbitrary classes     (bsc#1274276).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:52948 advisory.

    The IBM Semeru Runtime Certified Edition 21 runtime environment.

    Security Fix(es):

    * Little CMS: lcms2: mm2/Little-CMS: Little CMS: Information disclosure or denial of service via integer     overflow in CubeSize (CVE-2026-41254)

    * openjdk: Enhance TLS certificate handling (CVE-2026-46968)

    * openjdk: Improve DTLS handshaking (Oracle CPU 2026-07) (CVE-2026-46917)

    * openjdk: Enhance JPEG handling (Oracle CPU 2026-07) (CVE-2026-47010)

    * openjdk: Enhance XBM image support (Oracle CPU 2026-07) (CVE-2026-47021)

    * openjdk: Enhance Jar file processing (Oracle CPU 2026-07) (CVE-2026-47027)

    * openjdk: Enhance AWT ImagingLib (Oracle CPU 2026-07) (CVE-2026-47059)

    * openjdk: Enhance Jar handling (Oracle CPU 2026-07) (CVE-2026-47063)

    * openjdk: Improve certification checking (Oracle CPU 2026-07) (CVE-2026-60147)

    * Eclipse Foundation OpenJ9: Eclipse OpenJ9: Buffer underflow via tracing method arguments     (CVE-2026-16439)

    * Eclipse OMR: Eclipse OMR: Denial of service via improper input validation in arraycmp SIMD     (CVE-2026-16243)

    * Eclipse Foundation OpenJ9: Eclipse OpenJ9: Incorrect method delegation can lead to integrity issues     (CVE-2026-16441)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:52949 advisory.

    IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

    Security Fix(es):

    * Little CMS: lcms2: mm2/Little-CMS: Little CMS: Information disclosure or denial of service via integer     overflow in CubeSize (CVE-2026-41254)

    * openjdk: Enhance TLS certificate handling (CVE-2026-46968)

    * openjdk: Enhance JPEG handling (Oracle CPU 2026-07) (CVE-2026-47010)

    * openjdk: Enhance XBM image support (Oracle CPU 2026-07) (CVE-2026-47021)

    * openjdk: Enhance Jar file processing (Oracle CPU 2026-07) (CVE-2026-47027)

    * openjdk: Enhance AWT ImagingLib (Oracle CPU 2026-07) (CVE-2026-47059)

    * openjdk: Enhance Jar handling (Oracle CPU 2026-07) (CVE-2026-47063)

    * openjdk: Improve Nashorn index handling (Oracle CPU 2026-07) (CVE-2026-47057)

    * openjdk: Enhance Dataview Implementation (Oracle CPU 2026-07) (CVE-2026-47058)

    * openjdk: Improve certification checking (Oracle CPU 2026-07) (CVE-2026-60147)

    * Eclipse Foundation OpenJ9: Eclipse OpenJ9: Buffer underflow via tracing method arguments     (CVE-2026-16439)

    * Eclipse OMR: Eclipse OMR: Denial of service via improper input validation in arraycmp SIMD     (CVE-2026-16243)

    * Eclipse Foundation OpenJ9: Eclipse OpenJ9: Incorrect method delegation can lead to integrity issues     (CVE-2026-16441)

    * java-1.8.0-ibm: Arbitrary class loading and instantiation via malicious IIOP server (CVE-2026-8400)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of IBM Java installed on the remote host is 7.1 prior to 7.1.5.31 / 8.0 prior to 8.0.8.70. It is, therefore, affected by multiple vulnerabilities as referenced in the IBM Security Update July 2026 advisory.

  - In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass     method has been recompiled as abstract, execution is incorrectly delegated to an interface default method.
    (CVE-2026-16441)

  - In Eclipse OpenJ9 versions up to 0.60, using -Xtrace to trace method arguments can lead to buffer     underflow. (CVE-2026-16439)

  - In Eclipse OMR versions up to 0.11, the arraycmp SIMD implementation for Z and P does not check if the     number of bytes to compare is zero. (CVE-2026-16243)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
335503	SUSE SLES12: java-1_8_0-ibm / java-1_8_0-ibm-alsa / java-1_8_0-ibm-devel / etc (SUSE-SU-2026:3614-1)	Nessus	SuSE Local Security Checks	Local	medium
335501	SUSE SLES15: java-1_8_0-ibm / java-1_8_0-ibm-alsa / java-1_8_0-ibm-demo / etc (SUSE-SU-2026:3615-1)	Nessus	SuSE Local Security Checks	Local	medium
334419	RHEL 10 : java-21-ibm-semeru-certified-jdk (RHSA-2026:52948)	Nessus	Red Hat Local Security Checks	Local	medium
334416	RHEL 8 : java-1.8.0-ibm (RHSA-2026:52949)	Nessus	Red Hat Local Security Checks	Local	medium
331296	IBM Java 7.1 < 7.1.5.31 / 8.0 < 8.0.8.70 Multiple Vulnerabilities	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-16243

medium

Tenable Plugins

medium

medium

medium

medium

medium