CVE-2026-16441

In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstract, execution is incorrectly delegated to an interface default method.

CVSS v3 9.6 CRITICAL

9.6^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.8 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/eclipse-openj9/openj9/pull/24396	Issue Tracking Patch
https://github.com/eclipse-openj9/openj9/security/advisories/GHSA-hcfc-9hjx-2q7f	Broken Link
https://gitlab.eclipse.org/security/cve-assignment/-/work_items/194	Broken Link

Configurations

Configuration 1 (hide)

cpe:2.3:a:eclipse:openj9:*:*:*:*:*:*:*:*

History

24 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) En versiones de Eclipse OpenJ9 hasta la 0.60, al ejecutar archivos de clase donde un método de superclase previamente concreto ha sido recompilado como abstracto, la ejecución es delegada incorrectamente a un método predeterminado de interfaz.

Information

Published : 2026-07-21 19:17

Updated : 2026-10-24 19:10

NVD link : CVE-2026-16441

Mitre link : CVE-2026-16441

CVE.ORG link : CVE-2026-16441

JSON object : View

Products Affected

eclipse

openj9

CWE

CWE-758

Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

{"id": "CVE-2026-16441", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-16441", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-22T19:07:03.526762Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "emo@eclipse.org", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:N/VI:H/VA:L/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "emo@eclipse.org", "affectedData": [{"vendor": "Eclipse Foundation", "product": "OpenJ9", "versions": [{"status": "affected", "version": "0.8.0", "lessThan": "0.60.0", "versionType": "custom"}, {"status": "unaffected", "version": "0", "lessThan": "0.8.0", "versionType": "custom"}, {"status": "unaffected", "version": "0.60.0", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-21T19:17:09.990", "references": [{"url": "https://github.com/eclipse-openj9/openj9/pull/24396", "tags": ["Issue Tracking", "Patch"], "source": "emo@eclipse.org"}, {"url": "https://github.com/eclipse-openj9/openj9/security/advisories/GHSA-hcfc-9hjx-2q7f", "tags": ["Broken Link"], "source": "emo@eclipse.org"}, {"url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/194", "tags": ["Broken Link"], "source": "emo@eclipse.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "emo@eclipse.org", "description": [{"lang": "en", "value": "CWE-758"}]}], "descriptions": [{"lang": "en", "value": "In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstract, execution is incorrectly delegated to an interface default method."}, {"lang": "es", "value": "En versiones de Eclipse OpenJ9 hasta la 0.60, al ejecutar archivos de clase donde un m\u00e9todo de superclase previamente concreto ha sido recompilado como abstracto, la ejecuci\u00f3n es delegada incorrectamente a un m\u00e9todo predeterminado de interfaz."}], "lastModified": "2026-10-24T19:10:00.127", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:eclipse:openj9:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DCFB2B83-C50C-4461-BC4A-B1C8CE8FD33A", "versionEndExcluding": "0.60.0", "versionStartIncluding": "0.8.0"}], "operator": "OR"}]}], "sourceIdentifier": "emo@eclipse.org"}