CVE-2026-97400

medium

Description

In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an arbitrary local file named inside the bundle and send its contents to an arbitrary remote host.

References

https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/949

https://gitlab.eclipse.org/security/cve-assignment/-/work_items/324

https://github.com/eclipse-openj9/openj9/pull/25003

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-105014

Details

Source: Mitre, NVD

Published: 2026-10-20

Updated: 2026-10-20

Risk Information

CVSS v2

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Severity: High

CVSS v3

Base Score: 9.1

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Severity: Critical

CVSS v4

Base Score: 6.8

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Severity: Medium

EPSS

EPSS: 0.00164