CVE-2026-16439 is a critical (CVSS 9.1) buffer underflow in Eclipse OpenJ9 versions up to 0.60. It happens when the Xtrace option traces method arguments. The fix is a change on the 0.60 release branch, so move to an OpenJ9 build that includes it and check the Eclipse advisory for the exact version.
What's affected
Eclipse OpenJ9, the JVM used by many IBM Semeru and other OpenJDK builds, in versions up to and including 0.60. The record says the problem occurs when -Xtrace is used to trace method arguments.
The fix was merged on 21 July 2026 into the v0.60.0-release branch of the openj9 repository (pull request 24394, a backport of an earlier change on the main branch). The pages we read do not name a released version number, so confirm the first fixed build with the Eclipse security advisory or your JDK vendor before you close the ticket.
How to check if you're exposed
First find out whether you run OpenJ9 at all. The version banner names the JVM.
java -version
An OpenJ9 build prints a line that mentions OpenJ9 and its version. If you see HotSpot instead, this CVE does not apply.
Then look for tracing. The weak spot is only reachable when method argument tracing is switched on, so search your service definitions, container entrypoints and JAVA_TOOL_OPTIONS or IBM_JAVA_OPTIONS values for Xtrace.
grep -r "Xtrace" /etc /opt 2>/dev/null
Treat a match as a reason to patch first. No match lowers the practical risk but does not remove the need to update.
What to do now
- List every host and container image that runs OpenJ9 0.60 or earlier.
- Remove
-Xtracemethod argument tracing from production settings until the JVM is updated. - Update to an OpenJ9 or JDK vendor build that includes the 0.60 backport, and confirm the version against the Eclipse advisory.
- Redeploy images that bundle the JVM, then rescan them so old layers are not left behind.
Why it matters
The weakness class is CWE-124 (Buffer Underwrite). In the code that records method arguments for tracing, a corner case for a method with no arguments let a null byte be written to the memory just before the start of an allocated buffer. That is memory corruption, and the CVSS vector rates integrity and availability impact as high.
The vector says the attack needs no login and no user action, but in practice it depends on tracing being enabled, which most production JVMs do not do. That is why a configuration check is the fastest way to rank your systems. CISA does not list this CVE as known exploited, and we found no report of exploitation.
Try it yourself
This demo shows how to separate a CVE that is reachable in your setup from one that only exists on paper.
Click through it at your own pace, or open it full screen.
Quick check
Does this affect every Java application?
No. It affects Eclipse OpenJ9 up to 0.60, and the record ties it to method argument tracing. Oracle or OpenJDK HotSpot runtimes are not named.
Sources
Last reviewed: 19 October 2026.
