In Eclipse Open9J versions 0.21 to 0.58, a pre-authentication remote attacker can crash JITServer by sending a 32-byte crafted TCP message.

Eclipse OpenJ9 versions 0.21 to 0.58 contain a vulnerability where a pre-authentication remote attacker can crash the JITServer component by sending a specially crafted 32-byte TCP message. This denial of service vulnerability affects multiple versions of the OpenJ9 JVM implementation and can be exploited remotely without authentication. The vulnerability has been documented and patches are available through GitHub security advisories.