Eclipse Foundation vulnerabilities
310 CVEs and advisories name Eclipse Foundation as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-91059JPEG decoder: a duplicate SOF0 after SOS publishes a pixelmap that misreports its own allocation size
- CVE-2026-91189GUIX binary resource loader: unvalidated glyph range causes an integer underflow and a heap out-of-bounds write when loading an untrusted font or theme
- CVE-2026-92446GUIX binary resource loader reads past the end of a resource, because no length for it ever reaches the loader
- CVE-2026-92449Binary resource loader: unbounded map_id from a theme file causes a heap out-of-bounds write in the GUIX-allocated arena
- CVE-2026-91186PNG decoder: a duplicate IHDR chunk after IDAT resizes the image after allocation, causing a heap out-of-bounds write
- CVE-2026-95111Module queue front-send validates a word count as a byte count
- CVE-2026-96402USBX PIMA/MTP host class reads past its receive buffer when a device over-reports its object handle count
- CVE-2026-97400jdmpview / DTFJ reads arbitrary local files and makes arbitrary outbound requests when opening a third-party diagnostic dump bundle (XXE in XMLIndexReader)
- CVE-2026-96406VIDEO class descriptor walk consumes device-controlled wTotalLength as its bound
- CVE-2026-96582Out-of-bounds Read via Check-after-use in the USBX HID Report Descriptor Parser
- CVE-2026-91041FileX fault-tolerant log replay writes past the destination sector when mounting a crafted FAT image
- CVE-2026-113620Eclipse ioFog operator WebSocket accepts an unverified JWT
- CVE-2026-113619Eclipse ioFog renders request templates before authentication
- CVE-2026-107597jwks_uri from the OIDC discovery document is fetched without checking its origin or scheme
- CVE-2026-108062Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop
- CVE-2026-93649In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (
- CVE-2026-110723In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from t
- CVE-2026-110724In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from t
- CVE-2026-110726In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from t
- CVE-2026-18659Unauthenticated authorization bypass in ConstraintSecurityHandler - HTTP method-omission matched by substring
- CVE-2026-18662In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more security constraints with the same http
- CVE-2026-19864Eclipse Jetty's `SessionAuthentication` retains authentication credentials in a serializable object.
- CVE-2026-19863An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configure
- CVE-2026-18660Jetty proxy blacklist performs case-sensitive matching of case-insensitive DNS hostnames
- CVE-2026-18661In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the Jakarta Spec authoritative url-pattern ru
- CVE-2026-77711When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required
- CVE-2026-76184In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an attacker is able to control the r
- CVE-2026-76182In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as `index?p=$path`, whe
- CVE-2026-102477In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoint does have a configurable pe
- CVE-2026-102464In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Eclipse Vert.x MQTT (vertx-mqtt) MqttCl