Vendor
Eclipse Foundation
321 known vulnerabilities.
Products
321 results · Feed
-
High 8.7CVE-2026-102718 Public exploit
Out-of-bounds read in the NetX Duo SNMP OID parser via a multi-byte BER length
In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the SNMP agent's OID parser uses a multi-byte BER length from the request without checking it against the bytes present, and reads past the end of the packet buffer. A remote, unauthentica…
-
High 8.7
A malformed Session header permanently orphans one packet-pool block per RTSP request
In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the RTSP server returns a raw parser error for a malformed Session header and never releases the response packet it allocated. An unauthenticated client can drain the server's packet pool …
-
High 7.1
mDNS string cache accepts a shorter name as a match for a longer stored one, so the known-answer encoder writes past the transmit packet
In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the mDNS add-on's string cache accepts a shorter name as a match for a longer stored one. A host on the local link can send two mDNS records that make a device performing continuous servic…
-
High 7.1
ICMPv6 option validation accepts a trailing byte residue, sending the Router Advertisement, Neighbor Solicitation, Neighbor Advertisement and Redirect option walkers past the packet or into a permanent loop
In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, built with IPv6, the ICMPv6 option validator accepts an option area that ends in a one- or two-byte residue, and the Router Advertisement, Neighbor Solicitation, Neighbor Advertisement and…
-
High 8.3
Unbounded DATA datagram in the NetX Duo TFTP server causes an out-of-bounds read and a permanent stall
In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, built with packet chaining, the TFTP server does not bound the length of a received DATA datagram. An unauthenticated peer can upload an oversized datagram that writes memory beyond the re…
-
Medium 6.3
Out-of-bounds read in the NetX Secure DTLS ClientHello parser
In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, built with DTLS server support, the NetX Secure DTLS server's ClientHello parser reads the session ID, cookie and ciphersuite list without bounding them by the bytes remaining in the messa…
-
Medium 6.9
Out-of-bounds Read and Unverified Entry Pointers in the ThreadX Module Loader
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager loaders take a module image without its length and trust the sizes and offsets in its preamble. A crafted module image can declare a code size larger than the image to read, or gain ac…
-
High 8.5
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, built with TX_ENABLE_EVENT_TRACE, the Module Manager lets a use…
-
High 8.4
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the four non-secure-callable secure stack functions of the Trus…
-
High 8.2
The NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH message. Each malformed PUBLISH costs one packet…
-
Critical 9.3
NetX Duo's WebSocket client resets the unmasking cursor to the first `NX_PACKET` each time it advances through a chaine…
-
High 8.3
When NetX Secure is built with `NX_SECURE_KEY_CLEAR`, every TLS record sent on an active session is wiped after it has …
-
Medium 6.3
NetX Secure TLS accepts an empty application-data record without verifying its message authentication code. In `_nx_sec…
-
High 7.5
The `_nx_secure_x509_asn1_tlv_block_parse()` function parses ASN.1 TLV (tag-length-value) blocks out of DER-encoded dat…
-
High 8.5
An unprivileged, memory-protected ThreadX module can have the kernel read and write memory at addresses of its choosing…
-
High 8.7
Reflected arbitrary origins with credentials, allowing cross-origin reads of authenticated user data
The open-vsx.org deployment returned Access-Control-Allow-Origin reflecting the requesting origin together with Access-Control-Allow-Credentials: true on the authenticated /user/ endpoints. A page on any origin could therefore issue credentialed requests to t…
-
Low 1.0
Unsoundness in UTF-8 'String' trait
In Eclipse iceoryx2 versions greater than v0.8.0, the StaticString exposes its contents as mutable bytes through safe APIs, while String::as_str() converts those bytes into a Rust string slice without validating UTF-8. An application can therefore create an i…
-
Critical 9.1
UrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from the X-Forw…
-
Medium 4.8
In Eclipse Ankaios versions 0.6.0 to before 1.0.4, `LogRule::matches` in the agent control-interface authorizer stops a…
-
High 8.4
In Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload files and Control Interface named pipes (FI…
-
Medium 6.3
In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID.
-
Critical 9.1
In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised CMSIS pack the archive ext…
-
Medium 4.3
Publishing limits the compressed size of a VSIX (ovsx.publishing.max-content-size, 512 MB by default) but nothing limit…
-
Critical 9.2
In Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-ditto/ditto-javascript-client-node from…
-
Critical 9.9
In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Identit…
-
High 8.7
A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventuall…
-
High 8.3
A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary p…
-
Medium 6.3
In Eclipse Che versions 7.79.0 through 7.121.0, the dashboard backend's POST /dashboard/api/data/resolver endpoint pass…
-
High 8.7
A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to a…
-
Medium 6.8
In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a workload in a length…
-
High 8.3
In Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Interface authorizer incorrectly evaluates mu…
-
High 8.3
In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Federat…
-
High 8.8
Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in the REST API. User-c…
-
High 8.9
In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that protects every /…/mgmt/… REST …
-
Critical 9.5
In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled with the certificate authentication poli…
-
Critical 9.0
In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance i…
-
High 7.6
In Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper of the connectivity service builds a C…
-
Medium 5.3
In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT (Web of Things) ThingModels over HTTP from URL…
-
High 8.8
In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools (writeFileConten…
-
Critical 9.1
OAuth 1.0 session-fixation chain via unauthenticated provisional-consumer registration and insecure v1_0Allowed default
In Eclipse Lyo versions 2.0.0 to 7.0.0, OAuth server authorization checks can be bypassed when the 2-legged auth is supported by the server. In those cases, application that based their authz filters upon Lyo-provided `AbstractAdapterCredentialsFilter`, are v…