CVE-2026-97400CWE-611CWE-618xxe

CVE-2026-97400

published October 20, 2026

CVSS
6.8
EPSS
0%
Percentile
5.3
In the wild
Unconfirmed
What it is

In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an arbitrary local file named inside the bundle and send its contents to an arbitrary remote host.

The record
Technical detail
CVSS
6.8 · NONE
CVSS v4.0
6.8 · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00164 · 5.3th percentile
Weaknesses
CWE-611 · Improper Restriction of XML External Entity Reference; CWE-618 · Exposed Unsafe ActiveX Method
Published
2026-10-20T19:17Z
References (3)
https://github.com/eclipse-openj9/openj9/pull/25003 · [email protected]https://gitlab.eclipse.org/security/cve-assignment/-/work_items/324 · [email protected]https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/949 · [email protected]
EPSS history
Timeline
  • 22 OCT 03:36Z
    EPSS moved — → 0%
    epss
  • 20 OCT 14:08Z
    jdmpview / DTFJ reads arbitrary local files and makes arbitrary outbound requests when opening a third-party diagnostic dump bundle (XXE in XMLIndexReader)
    cvelistv5
  • 20 OCT 14:08Z
    jdmpview / DTFJ reads arbitrary local files and makes arbitrary outbound requests when opening a third-party diagnostic dump bundle (XXE in XMLIndexReader)
    cvelistv5