Eclipse

Exploited now

None of this vendor's CVEs are on CISA's known-exploited list.

Recent

• 9.1CriticalJul 21, 2026Eclipse openj9 Memory corruptionCVE-2026-16439In Eclipse OpenJ9 versions up to 0.60, using -Xtrace to trace method arguments can lead to buffer underflow.
• 7.5HighJul 21, 2026Eclipse omr Memory corruptionCVE-2026-16243In Eclipse OMR versions up to 0.11, the arraycmp SIMD implementation for Z and P does not check if the number of bytes to compare is zero.
• 4.3MediumJul 21, 2026Eclipse hawkbit Auth bypass / access controlCVE-2026-16454In Eclipse hawkBit versions 1.0.3 and prior, a privilege escalation vulnerability (CWE-284 / CWE-862) has been identified in the Direct Device Integration (DDI) Controller. This vulnerability allows an authenticated device to escalate its permissions and bypass the strict boundaries of its assigned updates. Under normal operation, a device should be restricted strictly to the specific firmware artifacts explicitly assigned to it. However, this flaw enables any authenticated device to bypass t
• 8.2HighJul 14, 2026Eclipse kura Auth bypass / access controlCVE-2026-9561Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the authoritative source of the client IP address in audit log entries. The org.eclipse.kura.web2 (Web Console) and org.eclipse.kura.rest.provider (REST API) components use this header as the primary IP source when initializing audit context, and org.eclipse.kura.jetty.customizer unconditionally installs Jetty's ForwardedRequestCustomizer on all HTTP/HTTPS connectors, causing HttpServletRequest.getRemot
• 5.3MediumJul 14, 2026Eclipse jettyCVE-2026-8384In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served). However, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path
• 5.3MediumJul 14, 2026Eclipse jettyCVE-2026-6790In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present). This was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112). This mismatch can cause a number of problems that may be classified as vulnerabilities such as: * URI constructions (for example, for redirects -- this is typical for login p
• 7.5HighOct 10, 2023Eclipse jetty.project Memory corruptionCVE-2023-36478Eclipse Jetty provides a web server and servlet container. In versions 11.0.0 through 11.0.15, 10.0.0 through 10.0.15, and 9.0.0 through 9.4.52, an integer overflow in `MetaDataBuilder.checkSize` allows for HTTP/2 HPACK header values to exceed their size limit. `MetaDataBuilder.java` determines if a4.8% likely
• 7.5HighJun 16, 2017Eclipse jetty Information disclosureCVE-2017-9735Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.5.8% likely

See every Eclipse entry on the dashboard.

Top products

• jetty2 CVEs in the last year
• openj91 CVE in the last year, 1 critical
• omr1 CVE in the last year
• kura1 CVE in the last year
• hawkbit1 CVE in the last year

Advisories

Official advisories from the last 90 days that name this vendor's CVEs.

• Atlassian · Mar 19, 2024Atlassian Security Bulletin March 19, 2024CVE-2023-36478
• Atlassian · Nov 21, 2023Atlassian Security Bulletin November 21, 2023CVE-2017-9735