Eclipse Foundation vulnerabilities
We track 205 vulnerabilities in Eclipse Foundation products across 60+ products. 205 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on November 13, 2026.
Latest Eclipse Foundation vulnerabilities
- 8.8 High severity
Eclipse Theia: Inclusion of Functionality from Untrusted Control Sphere
In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a workspace were automatically loaded and could override or extend the AI agent's system prompts. An attacker could craft a malicious repository containing promp
- 8.8 High severity
Eclipse Theia: Inclusion of Functionality from Untrusted Control Sphere
In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g. .theia/tasks.json, .vscode/tasks.json) could be executed without requiring workspace trust. An attacker could craft a malicious repository that, when cloned and opened
- 8.8 High severity
Eclipse Theia: Inclusion of Functionality from Untrusted Control Sphere
In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its prompt context without distinguishing them from system instructions. An attacker could craft a malicious repository with adversarial direct
- 9.8 Critical severity
Eclipse 4diac: Use After Free
In Eclipse 4diac FORTE versions 3.0.0 to 3.1.0, a specially crafted DELETE connection command to the management interface can lead to a dangling pointer. This allows subsequent commands to access freed memory (use-after-free).
- 9.6 Critical severity
Eclipse Glassfish: Improper Neutralization of Special Elements used in an Expression Language Statement
A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The application processes .xml files and evaluates user-supplied values within a context where Expression
- 9.1 Critical severity
Eclipse Glassfish: Improper Control of Generation of Code
An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user with access to the panel can send crafted requests that allow the execution of arbitrary operating system commands with the privileges of th
- 8.6 High severity
Eclipse BaSyx: Server-Side Request Forgery
In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, the Operation Delegation feature fails to validate the destination URI of delegated requests. An unauthenticated remote attacker can exploit this design flaw to force the BaSyx server to ex
- 10.0 Critical severity
Eclipse BaSyx: Improper Limitation of a Pathname to a Restricted Directory
In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel HTTP API allows an unauthenticated remote attacker to perform a path traversal attack. By supplying a maliciously crafted fileName parameter du
- 9.8 Critical severity
Equinox OSGi: Missing Authentication for Critical Functionality
Eclipse Equinox OSGi 3.7.2 and earlier contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by sending payloads to the console interface. Attackers can connect to the OSGi console port and send base
- 9.8 Critical severity
Equinox OSGi: Missing Authentication for Critical Functionality
Eclipse Equinox OSGi versions 3.8 through 3.18 contain a remote code execution vulnerability in the console interface that allows unauthenticated attackers to execute arbitrary code by exploiting the fork command functionality. Attackers can establish a telnet
- 8.5 High severity
Eclipse KUKSA - Databroker: Missing Authentication for Critical Functionality
A client holding only a read JWT scope can still register itself as a signal provider through the production kuksa.val.v2 OpenProviderStream API by sending ProvideSignalRequest. 1. Obtain any valid token with only read scope. 2. Connect to the normal productio
- 9.1 Critical severity
Eclipse Jetty: Inconsistent Interpretation of HTTP Requests
In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: * https://w4ke.info/2025/06/18/funky-chunks.html * https://w4ke.info/2025/10/29/funky-chunks-2.html
- 7.4 High severity
Eclipse Jetty: Sensitive Information in Resource Not Removed Before Reuse
In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing th
- 9.8 Critical severity
Eclipse OpenMQ: Improper Limitation of a Pathname to a Restricted Directory
An unsafe parsing of OpenMQ's configuration in OpenMQ versions <6.5.2 and <6.9.0, allows a remote attacker to read arbitrary files from a MQ Broker's server. A full exploitation could read unauthorized files of the OpenMQ’s host OS. In some scenarios RCE could
- 7.5 High severity
Eclipse Jetty: Missing Release of Memory after Effective Lifetime
In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed and the corresponding response is not compressed. This happens because the JDK Infl
- 9.8 Critical severity
Eclipse OpenMQ: Use of Weak Credentials
OpenMQ exposes a TCP-based management service (imqbrokerd) that by default requires authentication. However, the product ships with a default administrative account (admin/ admin) and does not enforce a mandatory password change on first use. After the first s
- 8.8 High severity
Eclipse Theia - Website: Inclusion of Functionality from Untrusted Control Sphere
In the Eclipse Theia Website repository, the GitHub Actions workflow .github/workflows/preview.yml used pull_request_target trigger while checking out and executing untrusted pull request code. This allowed any GitHub user to execute arbitrary code in the repo
- 9.8 Critical severity
Eclipse OMR: Buffer Copy without Checking Size of Input
In the Eclipse OMR port library component since release 0.2.0, an API function to return the textual names of all supported processor features was not accounting for the separator inserted between processor features. If the output buffer supplied to this funct
- 7.5 High severity
Eclipse ThreadX - NetX Duo: Uncontrolled Resource Consumption
A denial-of-service vulnerability exists in the NetX IPv6 component functionality of Eclipse ThreadX NetX Duo. A specially crafted network packet of "Packet Too Big" with more than 15 different source address can lead to denial of service. An attacker can send
- 7.0 High severity
Eclipse ThreadX - USBX: Out-of-bounds Write
The function _ux_host_class_storage_media_mount() is responsible for mounting partitions on a USB mass storage device. When it encounters an extended partition entry in the partition table, it recursively calls itself to mount the next logical partition. This
- 7.2 High severity
BlueChi: Incorrect Authorization
A vulnerability was found in BlueChi, a multi-node systemd service controller used in RHIVOS. This flaw allows a user with root privileges on a managed node (qm) to create or override systemd service unit files that affect the host node. This issue can lead to
- 10.0 Critical severity
Cyclone Data Distribution Service: Improper Validation of Certificate Expiration
Improper verification of the time certificate in Eclipse Cyclone DDS before v0.10.5 allows attackers to bypass certificate checks and execute commands with System privileges.
- 8.1 High severity
Eclipse OMR: Out-of-bounds Read
In the Eclipse OMR compiler component, since release 0.7.0, an optimization enabled for Eclipse OpenJ9 consumers of OMR on Z processors incorrectly handles NUL (0x00) characters during the Latin-compatible charset (UTF-8, ISO8859-1, ASCII, etc) to IBM-1047/037
- 7.4 High severity
Jersey: Concurrent Execution using Shared Resource with Improper Synchronization
In Eclipse Jersey versions 2.45, 3.0.16, 3.1.9 a race condition can cause ignoring of critical SSL configurations - such as mutual authentication, custom key/trust stores, and other security settings. This issue may result in SSLHandshakeException under normal
- 7.5 High severity
Vert.x: Files or Directories Accessible to External Parties
In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], a StaticHandler configuration for restricting access to hidden files fails to restrict access to hidden directories, allowing unauthorized users to retrieve files within them (e.g. '.git/config').
- 9.8 Critical severity
NextX Duo: Out-of-bounds Read
In NetXDuo version before 6.4.4, a networking support module for Eclipse Foundation ThreadX, in the DHCPV6 client there was an unchecked index extracting the server DUID from the server reply. With a crafted packet, an attacker could cause an out of memory rea
- 7.5 High severity
NetX Duo: Out-of-bounds Read
In NextX Duo before 6.4.4, in the HTTP client module, the network support code for Eclipse Foundation ThreadX, the parsing of HTTP header fields was missing bounds verification. A crafted server response could cause undefined behavior.
- 9.1 Critical severity
USBX: Out-of-bounds Read
In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _ux_host_class_audio10_sam_parse_func() when parsing a list of sampling frequencies.
- 7.5 High severity
NetX Duo: Out-of-bounds Read
In NetX Duo before 6.4.4, the networking support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _nx_icmpv6_validate_options() when handling a packet with ICMP6 options.
- 7.5 High severity
NextX Duo: Out-of-bounds Read
In NextX Duo's snmp addon versions before 6.4.4, a part of the Eclipse Foundation ThreadX, an attacker could cause an out-of-bound read by a crafted SNMPv3 security parameters.
- 9.8 Critical severity
FileX: Improper Restriction of Operations within the Bounds of a Memory Buffer
In FileX before 6.4.2, the file support module for Eclipse Foundation ThreadX, there was a possible buffer overflow in the FileX RAM disk driver. It could cause a remote execurtion after receiving a crafted sequence of packets
- 9.1 Critical severity
NetX Duo: Out-of-bounds Read
In Eclipse Foundation NextX Duo before 6.4.4, a module of ThreadX, the _nx_secure_tls_process_clienthello() function was missing length verification of certain SSL/TLS client hello message: the ciphersuite length and compression method length. In case of an at
- 7.1 High severity
ThreadX: Improper Handling of Parameters
In Eclipse ThreadX before 6.4.3, when memory protection is enabled, syscall parameters verification wasn't enough, allowing an attacker to obtain an arbitrary memory read/write.
- 7.5 High severity
Eclipse Jetty: Uncontrolled Resource Consumption
In Eclipse Jetty, versions <=9.4.57, <=10.0.25, <=11.0.25, <=12.0.21, <=12.1.0.alpha2, an HTTP/2 client may trigger the server to send RST_STREAM frames, for example by sending frames that are malformed or that should not be sent in a particular stream state,
- 7.5 High severity
Jakarta Mail: Improper Neutralization of Input Terminators
In Jakarta Mail versions prior to 2.0.2 it is possible to perform an SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages.
- 9.8 Critical severity
Eclipse Glassfish: Improper Restriction of Excessive Authentication Attempts
In Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of failed login attempts. GlassFish 8.0.3 adds automatic attack protection documented in https://glassfish.org/docs/latest/se
- 7.8 High severity
OpenJ9: Stack-based Buffer Overflow
In Eclipse OpenJ9 versions up to 0.51, when used with OpenJDK version 8 a stack based buffer overflow can be caused by modifying a file on disk that is read when the JVM starts.
- 7.5 High severity
Jetty: Uncontrolled Resource Consumption
In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a
- 7.2 High severity
Jetty: Improper Resource Shutdown or Release
In Eclipse Jetty versions 9.4.0 to 9.4.56 a buffer can be incorrectly released when confronted with a gzip error when inflating a request body. This can result in corrupted and/or inadvertent sharing of data between requests.
- 7.5 High severity
ThreadX: Incomplete Cleanup
In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.3, an attacker can cause a denial of service by specially crafted packets. The core issue is missing closing of a file in case of an error condition, resulting in the 404 error fo