Vendor
Eclipse Foundation
321 known vulnerabilities.
Products
139 results · Clear filters · Feed
-
High 8.9
In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that protects every /…/mgmt/… REST …
-
High 7.6
In Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper of the connectivity service builds a C…
-
High 8.8
In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools (writeFileConten…
-
High 8.4
In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requir…
-
High 8.7
In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity (XXE) processing when parsi…
-
High 7.5
In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or…
-
High 7.5
In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download endpoi…
-
High 8.8
In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in ever…
-
High 7.5CVE-2026-12609 Scanner template
In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the `/hostedPlu…
-
High 8.8
In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a configured `RoleMapper`. O…
-
High 8.7
In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message c…
-
High 8.7
In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space han…
-
High 8.7
Digest authentication lossy encoding
In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historica…
-
High 8.8
Unauthenticated SSRF in PIA via OIDC issuer allowlist bypass
PIA's `POST /v1/upload/sbom` endpoint accepts a Bearer JWT and checks its **unverified** `iss` claim against an issuer allowlist using Python's `urlparse` before performing OIDC discovery with `requests`. Because `urlparse` and `requests`/`urllib3` parse an a…
-
High 7.5
Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests
For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak. This is particularly the case for 100-Continue, but any request where the network is slow can leak.
-
High 8.2
In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vert…
-
High 8.2
In versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession component of Eclipse V…
-
High 8.8
Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the authoritative source …
-
High 8.5
In Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attacker-controlled URL fro…
-
High 8.8
In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged terminal RPC over WebSo…
-
High 8.2
PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check (issuer.startswith(' https://ci.eclipse.…
-
High 7.5
In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default ma…
-
High 7.5
The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process …
-
High 8.4
[Eclipse Theia] Arbitrary Command Execution via Untrusted Workspace Task Definitions
In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g. .theia/tasks.json, .vscode/tasks.json) could be executed without requiring workspace trust. An attacker could craft a malicious repository that, when cloned and opened…
-
High 8.4
[Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat
In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a workspace were automatically loaded and could override or extend the AI agent's system prompts. An attacker could craft a malicious repository containing prom…
-
High 8.4
[Eclipse Theia] Indirect Prompt Injection via Adversarial Workspace File and Directory Names in AI Chat
In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its prompt context without distinguishing them from system instructions. An attacker could craft a malicious repository with adversarial direc…
-
High 8.6
Eclipse BaSyx Java Server SDK vulnerable to Server-Side Request Forgery
In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, the Operation Delegation feature fails to validate the destination URI of delegated requests. An unauthenticated remote attacker can exploit this design flaw to force the BaSyx server to e…
-
High 8.7
In Eclipse Open9J versions 0.21 to 0.58, a pre-authentication remote attacker can crash JITServer by sending a 32-byte …
-
High 8.5
A client holding only a read JWT scope can still register itself as a signal provider through the production kuksa.val.…
-
High 7.4CVE-2026-2332 Public exploit
HTTP Request Smuggling via Chunked Extension Quoted-String Parsing
In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: * https://w4ke.info/2025/06/18/funky-chunks.html * https://w4ke.info/2025/10/29/funky-chunks-2.htm…
-
High 7.4
Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables
In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing t…
-
High 7.5
The Eclipse Jetty Server Artifact has a Gzip request memory leak
In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed and the corresponding response is not compressed. This happens because the JDK Inf…
-
High 7.8
The vulnerability stems from an incorrect error-checking logic in the CreateCounter() function (in threadx/utility/rtos…
-
High 8.7
A denial-of-service vulnerability exists in the NetX IPv6 component functionality of Eclipse ThreadX NetX Duo. A specia…
-
High 7.2
Bluechi: privilege escalation in bluechi via unrestricted cross-node systemd dependencies
A vulnerability was found in BlueChi, a multi-node systemd service controller used in RHIVOS. This flaw allows a user with root privileges on a managed node (qm) to create or override systemd service unit files that affect the host node. This issue can lead t…
-
High 8.8
Web http client: Unchecked Server-Side Malicious Packet Issue
In NextX Duo before 6.4.4, in the HTTP client module, the network support code for Eclipse Foundation ThreadX, the parsing of HTTP header fields was missing bounds verification. A crafted server response could cause undefined behavior.
-
High 7.2
Improper Parameter Check in ThreadX Syscall Implementation
In Eclipse ThreadX before 6.4.3, when memory protection is enabled, syscall parameters verification wasn't enough, allowing an attacker to obtain an arbitrary memory read/write.
-
High 8.9
Eclipse GlassFish is vulnerable to Server Side Request Forgery attacks through specific endpoints
In Eclipse GlassFish since version 6.2.5 it is possible to perform a Server Side Request Forgery attack in specific endpoints.
-
High 7.6
A vulnerability in the Eclipse Open VSX Registry’s automated publishing system could have allowed unauthorized uploads …
-
High 7.0
Buffer Overflow in Eclipse OpenJ9
In Eclipse OpenJ9 versions up to 0.51, when used with OpenJDK version 8 a stack based buffer overflow can be caused by modifying a file on disk that is read when the JVM starts.