Uncontrolled Recursion in OpenJ9 - CVE-2026-16440
Published: August 19, 2026
Vulnerability identifier: #VU144400
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-16440
CWE-ID: CWE-674
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in the class file annotation parser in runtime/bcutil/cfreader.c when loading a crafted .class file with deeply nested annotations. A remote user can supply a specially crafted class file to cause a denial of service.
The JVM crashes during class loading in native code before any bytecode executes, and user interaction is required to load the crafted class file.
Affected software
OpenJ9
How to mitigate CVE-2026-16440
Install security update from vendor's website.
OpenJ9 - update to 0.61.0