CVE-2026-97400

UNKNOWN 0.0

jdmpview / DTFJ reads arbitrary local files and makes arbitrary outbound requests when opening a third-party diagnostic dump bundle (XXE in XMLIndexReader)

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an arbitrary local file named inside the bundle and send its contents to an arbitrary remote host.

CWE	CWE-611 CWE-618
Vendor	eclipse foundation
Product	eclipse openj9
Published	Oct 20, 2026
Last Updated	Oct 20, 2026

Stay Ahead of the Next One

Get instant alerts for eclipse foundation eclipse openj9

Be the first to know when new unknown vulnerabilities affecting eclipse foundation eclipse openj9 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Eclipse Foundation / Eclipse OpenJ9

0.8.0 < 0.63

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/eclipse-openj9/openj9/pull/25003 gitlab.eclipse.org: https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/949 gitlab.eclipse.org: https://gitlab.eclipse.org/security/cve-assignment/-/work_items/324

Credits

Duc Anh Nguyen (VinSOC) - [email protected]