Vendor
Eclipse Foundation
321 known vulnerabilities.
Products
139 results · Clear filters · Feed
-
High 8.2
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the MySQL message deco…
-
High 8.2
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the PostgreSQL message…
-
High 8.2
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x MySQL clien…
-
High 8.2
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the binary array decod…
-
High 8.2
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the TDS message decode…
-
High 8.2
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x Redis clien…
-
High 8.7
In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provides a body transforme…
-
High 8.7
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the WebSocket implemen…
-
High 8.7
In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x decoder uses a canoni…
-
High 8.6
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a scope bypass vulnera…
-
High 8.7
Out-of-bounds read via an empty signature BIT STRING in NetX Secure X.509 parsing
In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the NetX Secure X.509 parser accepts a certificate whose signature is an empty BIT STRING and records a signature length of 0xFFFFFFFF. A remote peer can present such a certificate during …
-
High 8.4
The GUIX binary resource (theme) loader sizes its arena and populates it in two separate passes that traverse the resou…
-
High 8.3
The JAXB factory methods historically relied solely on `FEATURE_SECURE_PROCESSING` to prevent XML External Entity (XXE)…
-
High 8.4
In Eclipse Che versions 7.29.0 and later, the GET `/api/scm/resolve` and `POST /api/factory/resolver` endpoints pass an…
-
High 8.3
In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached t…
-
High 7.5
MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash
MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash
-
High 8.6
Out-of-bounds Write via NAND Metadata Parsing at Mount in LevelX
Mounting an attacker-controlled NAND flash image (`lx_nand_flash_open()`) triggers an unbounded out-of-bounds heap **write** in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demo…
-
High 7.1
Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the PPP IPCP code parses a peer's Configure-Nak without validating each option's length. A malicious PPP peer can stall the PPP thread indefinitely with a zero-length option, taking the link down…
-
High 7.1
Out-of-bounds Read from Unvalidated MSRP Attribute List Length
In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, the MSRP parser uses the attribute list length from the received frame without comparing it with the packet length. An unauthenticated station on the same Layer…
-
High 7.1
NULL pointer dereference when evicting the last MSRP attribute in a participant's list
In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, evicting the last attribute in an MRP participant's list writes through a null successor pointer. An unauthenticated station on the same Layer 2 segment can fau…
-
High 7.1
NULL Pointer Dereference on MSRP Attribute Table Exhaustion
In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, the MSRP attribute lookup writes through the null pointer returned by its allocator when the ten-entry attribute table is full. An unauthenticated station on th…
-
High 8.7CVE-2026-102718 Public exploit
Out-of-bounds read in the NetX Duo SNMP OID parser via a multi-byte BER length
In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the SNMP agent's OID parser uses a multi-byte BER length from the request without checking it against the bytes present, and reads past the end of the packet buffer. A remote, unauthentica…
-
High 8.7
A malformed Session header permanently orphans one packet-pool block per RTSP request
In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the RTSP server returns a raw parser error for a malformed Session header and never releases the response packet it allocated. An unauthenticated client can drain the server's packet pool …
-
High 7.1
mDNS string cache accepts a shorter name as a match for a longer stored one, so the known-answer encoder writes past the transmit packet
In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the mDNS add-on's string cache accepts a shorter name as a match for a longer stored one. A host on the local link can send two mDNS records that make a device performing continuous servic…
-
High 7.1
ICMPv6 option validation accepts a trailing byte residue, sending the Router Advertisement, Neighbor Solicitation, Neighbor Advertisement and Redirect option walkers past the packet or into a permanent loop
In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, built with IPv6, the ICMPv6 option validator accepts an option area that ends in a one- or two-byte residue, and the Router Advertisement, Neighbor Solicitation, Neighbor Advertisement and…
-
High 8.3
Unbounded DATA datagram in the NetX Duo TFTP server causes an out-of-bounds read and a permanent stall
In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, built with packet chaining, the TFTP server does not bound the length of a received DATA datagram. An unauthenticated peer can upload an oversized datagram that writes memory beyond the re…
-
High 8.5
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, built with TX_ENABLE_EVENT_TRACE, the Module Manager lets a use…
-
High 8.4
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the four non-secure-callable secure stack functions of the Trus…
-
High 8.2
The NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH message. Each malformed PUBLISH costs one packet…
-
High 8.3
When NetX Secure is built with `NX_SECURE_KEY_CLEAR`, every TLS record sent on an active session is wiped after it has …
-
High 7.5
The `_nx_secure_x509_asn1_tlv_block_parse()` function parses ASN.1 TLV (tag-length-value) blocks out of DER-encoded dat…
-
High 8.5
An unprivileged, memory-protected ThreadX module can have the kernel read and write memory at addresses of its choosing…
-
High 8.7
Reflected arbitrary origins with credentials, allowing cross-origin reads of authenticated user data
The open-vsx.org deployment returned Access-Control-Allow-Origin reflecting the requesting origin together with Access-Control-Allow-Credentials: true on the authenticated /user/ endpoints. A page on any origin could therefore issue credentialed requests to t…
-
High 8.4
In Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload files and Control Interface named pipes (FI…
-
High 8.7
A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventuall…
-
High 8.3
A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary p…
-
High 8.7
A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to a…
-
High 8.3
In Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Interface authorizer incorrectly evaluates mu…
-
High 8.3
In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Federat…
-
High 8.8
Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in the REST API. User-c…