Eclipse OpenJ9 JITServer is vulnerable to a pre‑authentication remote crash. By sending a single 32‑byte crafted TCP packet, an attacker can cause the JITServer component to terminate. The effect is a loss of service for any JVMs using the compromised OpenJ9 build, disrupting application availability and potentially cascading into larger infrastructure downtime.

The flaw affects Eclipse OpenJ9 releases from version 0.21 through 0.58, all distributed by the Eclipse Foundation. Systems running any affected OpenJ9 JVM on Linux, Windows, macOS, or other supported platforms that accept network traffic to the JITServer endpoint are potentially vulnerable.

With a CVSS score of 8.7, the vulnerability carries a high severity rating. The EPSS score is not available, but the lack of an authentication requirement and the ability to trigger a crash from any remote host elevate the risk. The vulnerability is not listed in CISA’s KEV catalog, yet the simplicity of the exploit and its remote nature warrant rapid response. An attacker can reach the target by opening the JITServer TCP port and dispatching the malicious packet, making the flaw highly actionable.