An integer overflow in MessageBuffer::computeRequiredCapacity() causes the Eclipse OpenJ9 JITServer component to enter an infinite loop on the worker thread while processing an incoming TCP connection's 4‑byte length field. The overflow enables an unauthenticated remote attacker to create a small number of crafted connections that exhaust the entire compilation worker thread pool, resulting in a silent denial of service for all connected client JVMs. The weakness is an integer overflow (CWE‑190) and an infinite loop (CWE‑835).

Eclipse OpenJ9 releases before version 0.63.0 from the Eclipse Foundation are affected. All pre‑0.63.0 builds that include the JITServer component are vulnerable.

The CVSS score of 8.7 indicates high severity. Because the exploit requires no authentication and is performed over a standard TCP connection, the likely attack vector is externally reachable. While the EPSS score is currently unavailable, the lack of KEV listing does not diminish the potential for exploitation. The resulting impact is a complete halt of compilation services, which can cripple applications relying on just‑in-time compilation. Immediate action is required to mitigate potential service interruption.