SB2026091605 - IBM WebSphere Service Registry and Repository update for Eclipse OpenJ9

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026091605

SB2026091605 - IBM WebSphere Service Registry and Repository update for Eclipse OpenJ9

Published: September 16, 2026 Updated: September 30, 2026

Security Bulletin ID SB2026091605
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Uncontrolled Recursion (CVE-ID: CVE-2026-16440)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 6.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in the class file annotation parser in runtime/bcutil/cfreader.c when loading a crafted .class file with deeply nested annotations. A remote user can supply a specially crafted class file to cause a denial of service.

The JVM crashes during class loading in native code before any bytecode executes, and user interaction is required to load the crafted class file.


Remediation

Install update from vendor's website.

References