Eclipse Foundation vulnerabilities
We track 205 vulnerabilities in Eclipse Foundation products across 60+ products. 205 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on November 13, 2026.
Latest Eclipse Foundation vulnerabilities
- 8.3 High severity
Eclipse Jetty: Inconsistent Interpretation of HTTP Requests
A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling. This is caused by Jetty accepting a lone LF
- 8.7 High severity
Eclipse Jetty: Uncontrolled Resource Consumption
A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to become unresponsive. This is caused by a race condition in the server when handli
- 8.7 High severity
Eclipse Jetty: Allocation of Resources Without Limits or Throttling
A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap. This occurs when auto-fragmentation is enabled, as unknown opcodes byp
- 8.3 High severity
Eclipse Ankaios: Incorrect Authorization
In Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Interface authorizer incorrectly evaluates multi-segment allow rules whose first path segment is a wildcard. An authenticated workload with access restricted by such a rule can submit a
- 8.3 High severity
Eclipse aeriOS: Improper Certificate Validation
In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Federator component disables TLS certificate validation for outbound HTTPS connections by default. When the TLS_CERTIFICATE_VALIDATION environment v
- 8.8 High severity
Eclipse aeriOS: Improper Limitation of a Pathname to a Restricted Directory
Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in the REST API. User-controlled identifiers used to create, update, or delete Self-orchestrator resources were incorporated into filesystem paths without adequate
- 9.5 Critical severity
Eclipse Arrowhead: Authentication Bypass by Spoofing
In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled with the certificate authentication policy, CertificateMqttFilter parses an X.509 certificate that the client sends inside the MQTT message payload (the authentication field of Mqtt
- 8.9 High severity
Eclipse Arrowhead: Use of Non-Canonical URL Paths for Authorization Decisions
In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that protects every /…/mgmt/… REST endpoint decides whether to apply its check by calling request.getRequestURL().toString().contains("/mgmt/"). Tomcat returns getRequestURL()
- 9.0 Critical severity
Eclipse aeriOS: Improper Certificate Validation
In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API Gateway component had the disable_jwk_security parameter hard-coded to true, with no option to override it through the Hel
- 7.6 High severity
Eclipse Ditto: Improper Neutralization of Special Elements in Output Used by a Downstream Component
In Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command by substituting placeholder values (e.g. {{ header:device_id }}) resolved from inbound message headers into a pre-configur
- 8.8 High severity
Eclipse Theia: Improper Limitation of a Pathname to a Restricted Directory
In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools (writeFileContent, suggestFileContent, and the replacement and state helpers) resolved a model-supplied file path without a workspace-containment check. A cr
- 9.1 Critical severity
Eclipse Lyo: Incorrect Authorization
In Eclipse Lyo versions 2.0.0 to 7.0.0, OAuth server authorization checks can be bypassed when the 2-legged auth is supported by the server. In those cases, application that based their authz filters upon Lyo-provided `AbstractAdapterCredentialsFilter`, are vu
- 8.4 High severity
Eclipse Theia: External Control of System or Configuration Setting
In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first. This affects applications built on Theia that include the git integration, such as the Theia IDE. Bot
- 8.7 High severity
Eclipse RDF4J: Improper Restriction of XML External Entity Reference
In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity (XXE) processing when parsing untrusted XML-based RDF data or query results, permitting DOCTYPE declarations, external entity references, and external DTD loading. This
- 9.6 Critical severity
Eclipse GlassFish: Server-Side Request Forgery
In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin `gfresttoken` to attacker-controlled host if the victim is authenticated into the Admin Console -\> full unauthenticated takeover of Eclipse GlassFi
- 7.5 High severity
Eclipse Theia: Improper Limitation of a Pathname to a Restricted Directory
In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download endpoints (`GET /file`, `GET /files/`, `PUT /files/`) that convert a client-supplied URI directly to a filesystem path and stream the file, without
- 7.5 High severity
Eclipse Mojarra: Improper Limitation of a Pathname to a Restricted Directory
In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal requ
- 8.8 High severity
Eclipse Theia: Improper Limitation of a Pathname to a Restricted Directory
In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every filesystem-enabled deployment. The handler takes an attacker-supplied absolute path from the multipart `uri` field and calls `fs.move(tmp,
- 7.5 High severity
Eclipse Theia: Improper Limitation of a Pathname to a Restricted Directory
In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the `/hostedPlugin/:pluginId/:path(*)` HTTP endpoint, which resolves the requested file path with `path.resolve(localPath, filePath)` without verifying that
- 7.5 High severity
Eclipse Milo: Missing Release of Memory after Effective Lifetime
In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message chunks when a channel disconnects, allowing a remote unauthenticated client to exhaust pooled direct memory by repeatedly sending incomplete c
- 7.5 High severity
Eclipse Milo: Incorrect Authorization
In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization, allowing an anonymous or otherwise low-privileged client to execute a denied method by batching it wit
- 7.5 High severity
Eclipse Milo: Uncontrolled Resource Consumption
In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server-global reservation is not restored. Deeply nested PubSub ExtensionObjects in a `CreateMonitoredItems
- 7.4 High severity
Eclipse Milo: Observable Response Discrepancy
In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim's `Basic128Rsa15`-encrypted usernam
- 8.2 High severity
Eclipse Milo: Missing Authorization
In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a configured `RoleMapper`. On servers that rely on role permissions and construct the running configuration through `copy()`, sessions receive no role IDs and the defaul
- 9.1 Critical severity
Eclipse Jetty - EE8: Improper Handling of Alternate Encoding
In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical
- 8.8 High severity
Eclipse CSI - PIA: Server-Side Request Forgery
PIA's `POST /v1/upload/sbom` endpoint accepts a Bearer JWT and checks its **unverified** `iss` claim against an issuer allowlist using Python's `urlparse` before performing OIDC discovery with `requests`. Because `urlparse` and `requests`/`urllib3` parse an au
- 9.8 Critical severity
Eclipse BaSyx Go Components: Incorrect Behavior Order: Validate Before Canonicalize
In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled deployments are vulnerable to an authorization bypass caused by inconsistent trailing-slash handling between the ABAC middleware and the HTTP router. The shared router configuratio
- 9.6 Critical severity
OpenJ9: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstract, execution is incorrectly delegated to an interface default method.
- 8.2 High severity
Eclipse Kura: Insufficient Verification of Data Authenticity
Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the authoritative source of the client IP address in audit log entries. The org.eclipse.kura.web2 (Web Console) and org.eclipse.kura.rest.provider (REST API) componen
- 9.0 Critical severity
Eclipse BaSyx - Java Server SDK: Improper Limitation of a Pathname to a Restricted Directory
In Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12, deployments using the MongoDB backend are vulnerable to an unauthenticated arbitrary file write through the AAS thumbnail API. The AAS thumbnail upload path accepted a client-c
- 7.5 High severity
Eclipse Vert.x: Origin Validation Error
In versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession component of Eclipse Vert.x Web Client does not validate that the Domain attribute of a Set-Cookie response header matches the originating server's domain, in viol
- 7.5 High severity
Eclipse Vert.x: Exposure of Sensitive Information to an Unauthorized Actor
In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core) propagates all request headers as-is across cross-origin HTTP 30x redirects. Only Content-Length is stripped; no origin comparison (s
- 7.5 High severity
Eclipse Jetty: Exposure of Sensitive Information to an Unauthorized Actor
In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection. Subsequent request that do not have trailers report the trailers of the first request. Subsequent reque
- 7.5 High severity
Eclipse Jetty: Uncontrolled Resource Consumption
For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak. This is particularly the case for 100-Continue, but any request where the network is slow can leak.
- 8.5 High severity
Eclipse Theia: Exposure of Sensitive Information to an Unauthorized Actor
In Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attacker-controlled URL from any client connected to the standard /services messaging endpoint, performs the HTTP request server-side, and returns the full response bod
- 8.8 High severity
Eclipse Theia: Missing Authentication for Critical Functionality
In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged terminal RPC over WebSocket (/services/shell-terminal, /services/terminals/:id) without service-level authentication. WebSocket origin validation in @theia/core is
- 8.2 High severity
Eclipse CSI - PIA: Server-Side Request Forgery
PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check (issuer.startswith(' https://ci.eclipse.org ') in is_issuer_known, pia/models.py:139) instead of validating the issuer as a properly host-bounded URL. An attacker can craft an issue
- 7.5 High severity
Eclipse Parsson: Uncontrolled Resource Consumption
In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default maximum on the number of characters consumed while parsing a single JSON document. Applications that parse attacker- controlled JSON can be for
- 8.7 High severity
Eclipse Open VSX: Improper Neutralization of Input During Web Page Generation
In Open VSX Registry before 1.0.2, the /vscode/unpkg/ endpoint serves user-supplied HTML files with Content-Type: text/html and without a Content-Security-Policy or Content-Disposition: attachment response header. An unauthenticated attacker can register a pub
- 7.5 High severity
Eclipse ThreadX - NetX Duo: Incomplete Cleanup
The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this unified cleanup path unconditionally calls fx_file_close() even when the file was never successfully