SB20260819144 - Uncontrolled Recursion in OpenJ9

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260819144

SB20260819144 - Uncontrolled Recursion in OpenJ9

Published: August 19, 2026

Security Bulletin ID SB20260819144
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Uncontrolled Recursion (CVE-ID: CVE-2026-16440)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 6.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in the class file annotation parser in runtime/bcutil/cfreader.c when loading a crafted .class file with deeply nested annotations. A remote user can supply a specially crafted class file to cause a denial of service.

The JVM crashes during class loading in native code before any bytecode executes, and user interaction is required to load the crafted class file.


Remediation

Install update from vendor's website.

References