Eclipse Foundation
Page 2 of 2 — Eclipse Foundation CVEs from a corpus of 143, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-13009 | High | 7.2 | 2025-05-08 | In Eclipse Jetty versions 9.4.0 to 9.4.56 a buffer can be incorrectly released when confronted with a gzip error when inflating a request body. This can result… |
CVE-2025-2260 | High | 7.5 | 2025-04-06 | In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.3, an attacker can cause a denial of service by specially crafted packets. T… |
CVE-2025-2259 | High | 7.5 | 2025-04-06 | In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.3, an attacker can cause an integer underflow and a subsequent denial of ser… |
CVE-2025-2258 | High | 7.5 | 2025-04-06 | In NetX Duo component HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.3, an attacker can cause an integer underflow and a subsequent… |
CVE-2024-10838 | Critical | 9.1 | 2025-03-12 | An integer underflow during deserialization may allow any unauthenticated user to read out of bounds heap memory. This may result into secret data or pointers… |
CVE-2025-1471 | High | 7.8 | 2025-02-21 | In Eclipse OMR versions 0.2.0 to 0.4.0, some of the z/OS atoe print functions use a constant length buffer for string conversion. If the input format string an… |
CVE-2025-1470 | Medium | 5.5 | 2025-02-21 | In Eclipse OMR, from the initial contribution to version 0.4.0, some OMR internal port library and utilities consumers of z/OS atoe functions do not check thei… |
CVE-2025-0728 | High | 7.5 | 2025-02-21 | In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.2, an attacker can cause an integer underflow and a subsequent denial of ser… |
CVE-2025-0727 | High | 7.5 | 2025-02-21 | In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.2, an attacker can cause an integer underflow and a subsequent denial of ser… |
CVE-2025-0726 | High | 7.5 | 2025-02-21 | In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.2, an attacker can cause a denial of service by specially crafted packets. T… |
CVE-2025-1007 | Medium | 5.3 | 2025-02-19 | In OpenVSX version v0.9.0 to v0.20.0, the /user/namespace/{namespace}/details API allows a user to edit all namespace details, even if the user is not a name… |
CVE-2024-10917 | Low | 3.7 | 2024-11-11 | In Eclipse OpenJ9 versions up to 0.47, the JNI function GetStringUTFLength may return an incorrect value which has wrapped around. From 0.48 the value is corre… |
CVE-2024-3935 | Medium | 6.5 | 2024-10-30 | In Eclipse Mosquito, versions from 2.0.0 through 2.0.18, if a Mosquitto broker is configured to create an outgoing bridge connection, and that bridge connectio… |
CVE-2024-10525 | Critical | 9.8 | 2024-10-30 | In Eclipse Mosquitto, from version 1.3.2 through 2.0.18, if a malicious broker sends a crafted SUBACK packet with no reason codes, a client using libmosquitto… |
CVE-2024-8184 | Medium | 5.9 | 2024-10-14 | There exists a security vulnerability in Jetty's ThreadLimitHandler.getRemote() which can be exploited by unauthorized users to cause remote denial-of-service… |
CVE-2024-6763 | Low | 3.7 | 2024-10-14 | Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing. The Htt… |
CVE-2024-6762 | Low | 3.1 | 2024-10-14 | Jetty PushSessionCacheFilter can be exploited by unauthenticated users to launch remote DoS attacks by exhausting the server’s memory. |
CVE-2024-9823 | Medium | 5.3 | 2024-10-14 | There exists a security vulnerability in Jetty's DosFilter which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack on the s… |
CVE-2024-8376 | High | 7.5 | 2024-10-11 | In Eclipse Mosquitto up to version 2.0.18a, an attacker can achieve memory leaking, segmentation fault or heap-use-after-free by sending specific sequences of… |
CVE-2024-9329 | Medium | 6.1 | 2024-09-30 | In Eclipse Glassfish versions before 7.0.17, The Host HTTP parameter could cause the web application to redirect to the specified URL, when the requested endpo… |
CVE-2024-9202 | Medium | 5.3 | 2024-09-27 | In Eclipse Dataspace Components versions 0.1.3 to 0.9.0, the Connector component filters which datasets (= data offers) another party can see in a requested ca… |
CVE-2024-8646 | Medium | 6.1 | 2024-09-11 | In Eclipse Glassfish versions prior to 7.0.10, a URL redirection vulnerability to untrusted sites existed. This vulnerability is caused by the vulnerability (C… |
CVE-2024-8642 | High | 8.1 | 2024-09-11 | In Eclipse Dataspace Components, from version 0.5.0 and before version 0.9.0, the ConsumerPullTransferTokenValidationApiController does not check for token val… |
CVE-2024-8391 | High | 7.5 | 2024-09-04 | In Eclipse Vert.x version 4.3.0 to 4.5.9, the gRPC server does not limit the maximum length of message payload (Maven GAV: io.vertx:vertx-grpc-server and io.ve… |
CVE-2023-7272 | High | 8.6 | 2024-07-17 | In Eclipse Parsson before 1.0.4 and 1.1.3, a document with a large depth of nested objects can allow an attacker to cause a Java stack overflow exception and d… |
CVE-2024-3933 | Medium | 5.3 | 2024-05-27 | In Eclipse OpenJ9 release versions prior to 0.44.0 and after 0.13.0, when running with JVM option -Xgc:concurrentScavenge, the sequence generated for System.ar… |
CVE-2024-5165 | Medium | 6.5 | 2024-05-23 | In Eclipse Ditto versions 3.0.0 to 3.5.5, the user input of several input fields of the Eclipse Ditto Explorer User Interface https://eclipse.dev/ditto/user-i… |
CVE-2024-4536 | Medium | 6.8 | 2024-05-07 | In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, in the EDC Connector component ( https://github.com/eclipse-edc/Connector ), an attacker might obt… |
CVE-2024-0740 | Critical | 9.8 | 2024-04-26 | Eclipse Target Management: Terminal and Remote System Explorer (RSE) version <= 4.5.400 has a remote code execution vulnerability that does not require authent… |
CVE-2024-3046 | High | 7.5 | 2024-04-09 | In Eclipse Kura LogServlet component included in versions 5.0.0 to 5.4.1, a specifically crafted request to the servlet can allow an unauthenticated user to re… |
CVE-2024-2452 | High | 7.0 | 2024-03-26 | In Eclipse ThreadX NetX Duo before 6.4.0, if an attacker can control parameters of __portable_aligned_alloc() could cause an integer wrap-around and an alloc… |
CVE-2024-2214 | High | 7.0 | 2024-03-26 | In Eclipse ThreadX before version 6.4.0, the _Mtxinit() function in the Xtensa port was missing an array size check causing a memory overwrite. The affected… |
CVE-2024-2212 | High | 7.3 | 2024-03-26 | In Eclipse ThreadX before 6.4.0, xQueueCreate() and xQueueCreateSet() functions from the FreeRTOS compatibility API (utility/rtos_compatibility_layers/FreeR… |
CVE-2023-6194 | Low | 2.8 | 2023-12-11 | In Eclipse Memory Analyzer versions 0.7 to 1.14.0, report definition XML files are not filtered to prohibit document type definition (DTD) references to extern… |
CVE-2023-5676 | Medium | 4.1 | 2023-11-15 | In Eclipse OpenJ9 before version 0.41.0, the JVM can be forced into an infinite busy hang on a spinlock or a segmentation fault if a shutdown signal (SIGTERM… |
CVE-2023-4218 | Medium | 5.0 | 2023-11-09 | In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any ev… |
CVE-2023-4043 | Medium | 5.9 | 2023-11-03 | In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support… |
CVE-2023-5763 | Medium | 6.8 | 2023-11-03 | In Eclipse Glassfish 5 or 6, running with old versions of JDK (lower than 6u211, or < 7u201, or < 8u191), allows remote attackers to load malicious code on the… |
CVE-2023-4760 | High | 7.6 | 2023-09-21 | In Eclipse RAP versions from 3.0.0 up to and including 3.25.0, Remote Code Execution is possible on Windows when using the FileUpload component. The reas… |
CVE-2023-4759 | High | 8.8 | 2023-09-12 | Arbitrary File Overwrite in Eclipse JGit <= 6.6.0 In Eclipse JGit, all versions <= 6.6.0.202305301015-r, a symbolic link present in a specially crafted git re… |
CVE-2023-2597 | High | 7.0 | 2023-05-22 | In Eclipse Openj9 before version 0.38.0, in the implementation of the shared cache (which is enabled by default in OpenJ9 builds) the size of a string is not p… |
CVE-2017-7650 | Medium | 6.5 | 2017-09-11 | In Mosquitto before 1.4.12, pattern based ACLs can be bypassed by clients that set their username/client id to '#' or '+'. This allows locally or remotely conn… |
CVE-2017-7649 | Critical | 9.8 | 2017-09-11 | The network enabled distribution of Kura before 2.1.0 takes control over the device's firewall setup but does not allow IPv6 firewall rules to be configured. S… |