Eclipse Ditto vulnerabilities

2 known vulnerabilities in Eclipse Ditto from Eclipse Foundation. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.2 Critical severity

  Eclipse Ditto: Improper Certificate Validation

  CVE-2026-84197Sep 8, 2026Eclipse Foundation

  In Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-ditto/ditto-javascript-client-node from 2.0.0 to 3.9.0 and of its predecessor package @eclipse-ditto/ditto-javascript-client-node_1.0 from 1.0.0 to 2.1.0, the WebSocket transport h

• 7.6 High severity

  Eclipse Ditto: Improper Neutralization of Special Elements in Output Used by a Downstream Component

  CVE-2026-82958Sep 2, 2026Eclipse Foundation

  In Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command by substituting placeholder values (e.g. {{ header:device_id }}) resolved from inbound message headers into a pre-configur