Security Bulletin: SOAR App Host is vulnerable to using components with known vulnerabilities (CVE-2026-16440)

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. SOAR APP host has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-16440 DESCRIPTION: In Eclipse OpenJ9 versions up to 0.60, a...

CVE-2026-110938

In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper boundary checks during protocol message and reply handling. An unauthenticated remote attacker or malicious JITServer can transmit malformed network payloads that cause out-of-bound...

CVE-2026-111075

In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled size, paddingSize, and dataOffset fields during DataDescriptor message deserialization. An unauthenticated remote attacker can send a crafted network payload that...

CVE-2026-111074

In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remote denial of service. When processing the initial 4-byte length field of an incoming TCP connection, an integer overflow in MessageBuffer::computeRequiredCapacity causes the receiving...

CVE-2026-110938 JITServer: Multiple Denial of Service vulnerabilities via out-of-bounds heap reads during message and reply parsing

In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper boundary checks during protocol message and reply handling. An unauthenticated remote attacker or malicious JITServer can transmit malformed network payloads that cause out-of-bound...

CVE-2026-110938 JITServer: Multiple Denial of Service vulnerabilities via out-of-bounds heap reads during message and reply parsing

In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper boundary checks during protocol message and reply handling. An unauthenticated remote attacker or malicious JITServer can transmit malformed network payloads that cause out-of-bound...

EUVD-2026-107139

In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper boundary checks during protocol message and reply handling. An unauthenticated remote attacker or malicious JITServer can transmit malformed network payloads that cause out-of-bound...

CVE-2026-110938

Eclipse OpenJ9 versions up to 0.63.0 are vulnerable to a Denial of Service (DoS) via out-of-bounds heap reads in the JITServer component. The root cause is improper boundary checks during the handling of protocol messages and replies. An unauthenticated remote attacker or a malicious JITServer ca...

CVE-2026-110938 JITServer: Multiple Denial of Service vulnerabilities via out-of-bounds heap reads during message and reply parsing

In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper boundary checks during protocol message and reply handling. An unauthenticated remote attacker or malicious JITServer can transmit malformed network payloads that cause out-of-bound...

CVE-2026-111075 JITServer: Pre-authentication remote crash via integer underflow and out-of-bounds heap read in DataDescriptor deserialization

In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled size, paddingSize, and dataOffset fields during DataDescriptor message deserialization. An unauthenticated remote attacker can send a crafted network payload that...

CVE-2026-111075 JITServer: Pre-authentication remote crash via integer underflow and out-of-bounds heap read in DataDescriptor deserialization

In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled size, paddingSize, and dataOffset fields during DataDescriptor message deserialization. An unauthenticated remote attacker can send a crafted network payload that...

CVE-2026-111075 JITServer: Pre-authentication remote crash via integer underflow and out-of-bounds heap read in DataDescriptor deserialization

In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled size, paddingSize, and dataOffset fields during DataDescriptor message deserialization. An unauthenticated remote attacker can send a crafted network payload that...

EUVD-2026-107138

In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled size, paddingSize, and dataOffset fields during DataDescriptor message deserialization. An unauthenticated remote attacker can send a crafted network payload that...

CVE-2026-111075

In Eclipse OpenJ9 versions prior to 0.63.0 , a vulnerability exists in the JITServer component due to missing cross-field validation on _size, _paddingSize, and _dataOffset fields during DataDescriptor message deserialization. An unauthenticated remote attacker can provide a crafted network paylo...

CVE-2026-111074 JITServer: Pre-authentication remote Denial of Service via integer overflow infinite loop in MessageBuffer::computeRequiredCapacity()

In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remote denial of service. When processing the initial 4-byte length field of an incoming TCP connection, an integer overflow in MessageBuffer::computeRequiredCapacity causes the receiving...

EUVD-2026-107134

In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remote denial of service. When processing the initial 4-byte length field of an incoming TCP connection, an integer overflow in MessageBuffer::computeRequiredCapacity causes the receiving...

CVE-2026-111074 JITServer: Pre-authentication remote Denial of Service via integer overflow infinite loop in MessageBuffer::computeRequiredCapacity()

In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remote denial of service. When processing the initial 4-byte length field of an incoming TCP connection, an integer overflow in MessageBuffer::computeRequiredCapacity causes the receiving...

CVE-2026-111074

Eclipse OpenJ9 versions prior to 0.63.0 are vulnerable to a pre-authentication remote denial of service . The issue resides in the JITServer component where an integer overflow in MessageBuffer::computeRequiredCapacity() occurs when processing the initial 4-byte length field of an incoming TCP co...

PT-2026-120494

In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled size, paddingSize, and dataOffset fields during DataDescriptor message deserialization. An unauthenticated remote attacker can send a crafted network payload that...

PT-2026-120493

In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remote denial of service. When processing the initial 4-byte length field of an incoming TCP connection, an integer overflow in MessageBuffer::computeRequiredCapacity causes the receiving...