In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled "_size", "_paddingSize", and "_dataOffset" fields during "DataDescriptor" message deserialization. An unauthenticated remote attacker can send a crafted network payload that triggers an unsigned integer underflow in "DataDescriptor::getPayloadSize()" and "DataDescriptor::getNextDescriptor()". This results in an out-of-bounds heap read and an immediate process crash (SIGSEGV), causing a denial of service.