Uncontrolled Recursion in OpenJ9 - CVE-2026-16440

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU144400

Uncontrolled Recursion in OpenJ9 - CVE-2026-16440

Published: August 19, 2026


Vulnerability identifier: #VU144400
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-16440
CWE-ID: CWE-674
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in the class file annotation parser in runtime/bcutil/cfreader.c when loading a crafted .class file with deeply nested annotations. A remote user can supply a specially crafted class file to cause a denial of service.

The JVM crashes during class loading in native code before any bytecode executes, and user interaction is required to load the crafted class file.


Affected software

OpenJ9
IBM Tivoli Business Service Manager
IBM Tivoli Netcool Impact
WebSphere Service Registry and Repository
IBM OpenPages with Watson
Integration Bus for z/OS
Rational Business Developer (RBD)
IBM App Connect Enterprise

How to mitigate CVE-2026-16440

Install security update from vendor's website.

OpenJ9 - update to 0.61.0
Rational Business Developer (RBD) - addressed in versions 9.6.2, 9.7.2
Integration Bus for z/OS - update to 10.1.0.7
IBM App Connect Enterprise - addressed in versions 12.0.12.30, 13.0.9.0
WebSphere Service Registry and Repository - update to 8.5.6.3 IJ59344

External References

Related Security Bulletins