Eclipse Foundation Vulnerabilities and Affected Products

Open in search

Explore source-attributed vulnerabilities associated with Eclipse Foundation products.

Products

Showing 25 vulnerabilities on this page

Signals CISA KEV Ransomware Nuclei
VulnerabilityTitle and contextCVSSEPSSPoCsSignals

Eclipse RDF4J XML External Entity (XXE) Injection

In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity (XXE) processing when parsing untrusted XML-based RDF data or query results, permitting DOCTYPE declarations, external entity references, and external DTD loading. This is due to an incomplete fix for CVE-2018-1000644: the earlier fix did not cover all parser entry points. The issue is resolved in RDF4J 5.3.2, which rejects or disables DOCTYPE declarations, external entities, and external DTD loading by d…

CWE-611CWE-827Aug 12, 2026
CVSS8.7v4.0EPSS0.343%PoCs0SignalsSTIX

Eclipse GlassFish DownloadServlet CSRF and SSRF Leading to Admin Token Leakage and Domain Takeover

In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin `gfresttoken` to attacker-controlled host if the victim is authenticated into the Admin Console -\> full unauthenticated takeover of Eclipse GlassFish domain until the token expires.

CWE-918Aug 6, 2026
CVSS9.6v3.1EPSS0.236%PoCs0SignalsSTIX

Eclipse Mojarra DefaultFaceletFactory Remote Facelet Inclusion

In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target server. This could allow access to restricted files such as `WEB-INF/web.xml` or `/etc/passwd`.

CWE-22CWE-641CWE-94Aug 5, 2026
CVSS7.5v3.1EPSS0.371%PoCs0SignalsSTIX

Eclipse Theia @theia/filesystem Unauthenticated Absolute Path Traversal Arbitrary File Read

In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download endpoints (`GET /file`, `GET /files/`, `PUT /files/`) that convert a client-supplied URI directly to a filesystem path and stream the file, without confining it to the workspace or any allow-listed root. In browser (non-Electron) deployments the connection token is enforced only on WebSocket upgrades; the HTTP middleware in `@theia/core` re-issues the cookie and calls `next()` without…

CWE-200CWE-22CWE-306CWE-36Aug 5, 2026
CVSS7.5v3.1EPSS0.451%PoCs0SignalsSTIX

Eclipse Theia Unauthenticated Arbitrary File Write via POST /file-upload

In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every filesystem-enabled deployment. The handler takes an attacker-supplied absolute path from the multipart `uri` field and calls `fs.move(tmp, target, { overwrite: true })` with no workspace confinement and no authentication. In browser (non-Electron) deployments the connection token is enforced only on WebSocket upgrades; the HTTP middleware in `@theia/core` re-issues the cookie …

CWE-22CWE-306CWE-352CWE-73Aug 5, 2026
CVSS8.8v3.1EPSS0.323%PoCs0SignalsSTIX

Eclipse Theia @theia/plugin-ext Path Traversal Arbitrary File Read

In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the `/hostedPlugin/:pluginId/:path(*)` HTTP endpoint, which resolves the requested file path with `path.resolve(localPath, filePath)` without verifying that the resolved path stays within the plugin's directory. An unauthenticated network attacker can send percent-encoded `../` sequences (`%2e%2e%2f`) that decode into the path parameter and escape the plugin directory, allowing arbitrary files…

CWE-22Aug 5, 2026
CVSS7.5v3.1EPSS0.409%PoCs0SignalsSTIX

Eclipse Theia Prototype Pollution via PreferenceUtils.merge

In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `PreferenceUtils.merge` function in `@theia/core` recursively merges preference values without rejecting prototype-related keys (`__proto__`, `constructor`, `prototype`). Because this function is invoked by `PreferenceServiceImpl.doResolve` for every preference resolution across scopes (default, user, workspace, folder), a crafted preference value in a workspace settings file (`.theia/settings.json` or `.vscode/settings.json`) ca…

CWE-1321Aug 5, 2026
CVSS5.7v4.0EPSS0.282%PoCs0SignalsSTIX

Eclipse Accessibility Tools Framework (ACTF) XML External Entity (XXE) Vulnerability

In Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code versions up to v20260630 and ACTF based application miChecker versions up to 3.1.0), it has been identified that an XML External Entity (XXE) vulnerability exists. If this vulnerability is exploited, a malicious third party could gain access to local resources or internal network resources via computer running applications that use Eclipse ACTF, including miChecker.

CWE-611Aug 5, 2026
CVSS4.6v4.0EPSS0.172%PoCs0SignalsSTIX

Eclipse Milo OPC UA Server Diagnostics Missing Authorization

In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization. An anonymous client can enable diagnostics over a None/None endpoint without a certificate; with a trusted client application certificate over SignAndEncrypt, it can read security diagnostics for other active sessions, exposing usernames, login history, authentication mechanisms, security modes and policies, and public client certificates.

CWE-862Aug 4, 2026
CVSS6.9v4.0EPSS0.156%PoCs0SignalsSTIX

Eclipse Milo Missing Authorization on RoleMapper in OpcUaServerConfig.copy()

In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a configured `RoleMapper`. On servers that rely on role permissions and construct the running configuration through `copy()`, sessions receive no role IDs and the default access controller skips role-permission checks, allowing an anonymous client where anonymous sessions are permitted to read role-permission metadata, invoke protected methods, or delete protected nodes.

CWE-862Aug 4, 2026
CVSS8.8v4.0EPSS0.269%PoCs0SignalsSTIX

Eclipse Milo UASC Server Missing Message Chunk Release Denial of Service

In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message chunks when a channel disconnects, allowing a remote unauthenticated client to exhaust pooled direct memory by repeatedly sending incomplete chunks and disconnecting, potentially terminating the server.

CWE-401Aug 4, 2026
CVSS8.7v4.0EPSS0.413%PoCs0SignalsSTIX

Eclipse Milo Incorrect Authorization in Call Service

In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization, allowing an anonymous or otherwise low-privileged client to execute a denied method by batching it with an allowed method.

CWE-863Aug 4, 2026
CVSS8.7v4.0EPSS0.298%PoCs0SignalsSTIX

Eclipse Milo Padding Oracle Authentication Bypass via Username-Token Processing

In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim's `Basic128Rsa15`-encrypted username token to use repeated unauthenticated `ActivateSession` requests as a padding oracle, recover the victim's password, and authenticate with the recovered credentials.

CWE-204Aug 4, 2026
CVSS9.1v4.0EPSS0.383%PoCs0SignalsSTIX

Eclipse Milo Monitored-Item Quota Exhaustion via Unchecked Exception in CreateMonitoredItems

In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server-global reservation is not restored. Deeply nested PubSub ExtensionObjects in a `CreateMonitoredItems` event filter can trigger a `StackOverflowError` during decoding, allowing an unauthenticated remote client to exhaust a finite global monitored-item quota and prevent all clients from creating new monitored items until restart. Existing m…

CWE-400CWE-460CWE-772Aug 4, 2026
CVSS6.9v4.0EPSS0.345%PoCs0SignalsSTIX

Digest authentication lossy encoding

In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts t…

CWE-173CWE-303Aug 4, 2026
CVSS8.7v4.0EPSS0.47%PoCs1SignalsSTIX

Unauthenticated SSRF in PIA via OIDC issuer allowlist bypass

PIA's `POST /v1/upload/sbom` endpoint accepts a Bearer JWT and checks its **unverified** `iss` claim against an issuer allowlist using Python's `urlparse` before performing OIDC discovery with `requests`. Because `urlparse` and `requests`/`urllib3` parse an authority string containing a backslash (e.g. `https://attacker-host\@ci.eclipse.org/`) into *different* hostnames, an attacker can craft an issuer that passes the allowlist check yet drives `requests` — and subsequently `urllib.request.urlop…

CWE-918Jul 30, 2026
CVSS8.8v4.0EPSS0.239%PoCs0SignalsSTIX

CWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSyx Go Components

In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled deployments are vulnerable to an authorization bypass caused by inconsistent trailing-slash handling between the ABAC middleware and the HTTP router. The shared router configuration used Chi's `middleware.StripSlashes`, so a request such as `GET /shells/` was dispatched to the registered `GET /shells` route. However, the ABAC middleware evaluated the original request path including the trailing slash. If ABAC rout…

CWE-180CWE-284CWE-863Jul 24, 2026
CVSS9.8v3.1EPSS0.353%PoCs0SignalsSTIX

Eclipse OpenJ9 : Method resolution default method precedence failure

In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstract, execution is incorrectly delegated to an interface default method.

CWE-758Jul 21, 2026
CVSS6.9v4.0EPSS0.297%PoCs0SignalsSTIX

Eclipse OMR : arraycmp SIMD implementation does not check if the number of bytes to compare is zero

In Eclipse OMR versions up to 0.11, the arraycmp SIMD implementation for Z and P does not check if the number of bytes to compare is zero.

CWE-125Jul 21, 2026
CVSS5.7v4.0EPSS0.364%PoCs0SignalsSTIX

Eclipse OpenJ9 : Using -Xtrace to trace method arguments can lead to buffer underflow

In Eclipse OpenJ9 versions up to 0.60, using -Xtrace to trace method arguments can lead to buffer underflow.

CWE-124Jul 21, 2026
CVSS5.8v4.0EPSS0.24%PoCs0SignalsSTIX

Privilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware Exfiltration

In Eclipse hawkBit versions 1.0.3 and prior, a privilege escalation vulnerability (CWE-284 / CWE-862) has been identified in the Direct Device Integration (DDI) Controller. This vulnerability allows an authenticated device to escalate its permissions and bypass the strict boundaries of its assigned updates. Under normal operation, a device should be restricted strictly to the specific firmware artifacts explicitly assigned to it. However, this flaw enables any authenticated device to bypass t…

CWE-284CWE-862Jul 21, 2026
CVSS4.3v3.1EPSS0.222%PoCs0SignalsSTIX

Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests

For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak. This is particularly the case for 100-Continue, but any request where the network is slow can leak.

CWE-400CWE-401Jul 14, 2026
CVSS7.5v3.1EPSS0.252%PoCs0SignalsSTIX

Eclipse Jetty: Path parameter traversal

In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served). However, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path…

CWE-647Jul 14, 2026
CVSS5.3v3.1EPSS0.228%PoCs0SignalsSTIX

Eclipse Jetty: HTTP Authority/Host mismatch

In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present). This was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112). This mismatch can cause a number of problems that may be classified as vulnerabilities such as: * URI constructions (for example, for redirects -- this is typical for login p…

CWE-20Jul 14, 2026
CVSS5.3v3.1EPSS0.196%PoCs0SignalsSTIX

Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections

In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection. Subsequent request that do not have trailers report the trailers of the first request. Subsequent request that do have trailers report the union of trailers of the first request and the current request.

CWE-200Jul 14, 2026
CVSS6.9v4.0EPSS0.302%PoCs0SignalsSTIX