Eclipse Foundation

Exploited now

None of this vendor's CVEs are on CISA's known-exploited list.

Recent

• 9.8CriticalOct 28, 2026Eclipse Che Code / command injectionCVE-2026-114278The che-machine-exec service constructs a shell command by concatenating user-controlled input (the username and namespace fields from the /exec/init and /exec/config JSON endpoints) into a double-quoted sh -c "echo "..." > ..." invocation without any escaping. When che-machine-exec is run with authentication disabled (its default), any network-reachable attacker can achieve remote code execution in containers che-machine-exec is configured to access, via shell command substitution ($(...) or ba
• 5.5MediumOct 27, 2026Eclipse KeyPont Auth bypass / access controlCVE-2026-115408In `github.com/eclipse-keypont/crypto11/v2` versions `>= 2.0.0-rc3, <= 2.0.0-rc8`, the ML-KEM key-pair lookup functions (`FindMLKEMKeyPair`, `FindMLKEMKeyPairs`, `FindMLKEMKeyPairsWithAttributes`) locate the public half of an ML-KEM key pair by `CKA_ID`/`CKA_LABEL` and never verify it against the private key. In addition, the "ID only" fallback search runs even when the private key has no `CKA_ID`, so the search template reduces to the public-key class and the ML-KEM key type and the first ML-KE
• 5.5MediumOct 27, 2026Eclipse ioFog Code / command injectionCVE-2026-113644In Eclipse ioFog iofogctl versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.9.1, the provisioning key and CA certificate returned by the Controller API are concatenated into shell commands (`edgelet provision` and `edgelet config cert` on supported releases; `iofog-agent provision` and `iofog-agent cert` on older releases) that run over SSH on a remote agent host and via a local shell. A party who can change that API response can include shell metacharacters and cause the operator's CLI to r
• 9.1CriticalOct 27, 2026Eclipse ioFog Crypto / certificateCVE-2026-115216In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs in to an external OIDC issuer. An on-path attacker can present any certificate, capture the OAuth client secret (external mode) or the Controller bootstrap admin password (embedded mode with Controller HTTPS enabled), and supply the access token the operator stores for later Controller API calls. v3.8 removed Keycloak. The exposed credenti
• 8.8HighOct 23, 2026Eclipse KeyPont - GOSECVE-2026-89320`HmacShaCryptor.Hash` never hashed its input. For any input it returned `HMAC_K("")` — the MAC of the empty message under the key. Every AES-CBC-HMAC JWE produced or verified by gose therefore carried an authentication tag that is constant per key and independent of the message, removing ciphertext integrity entirely.
• 6.3MediumOct 23, 2026Eclipse KeyPont - GOSECVE-2026-89319`JweDirectDecryptorBlock.Decrypt` read a 64-bit plaintext length from the `_thales_aad` protected-header field and used it without any validation. A truncated field panics `binary.BigEndian.Uint64`, an oversized value drives an unbounded allocation, and a value larger than the decrypted block panics with a slice-bounds error.
• 6.9MediumOct 23, 2026Eclipse KeyPont - GOSECVE-2026-89318`JweRsaKeyEncryptionDecryptorImpl.Decrypt` passed the JWE's initialization vector to `cipher.AEAD.Open` without checking its length. The Go standard library **panics** rather than returning an error when a GCM nonce is not exactly `NonceSize()` bytes, so a JWE carrying a wrong-sized IV crashes the decrypting goroutine.
• 6.3MediumOct 23, 2026Eclipse KeyPont - GOSECVE-2026-89317gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read it. RFC 7515 §4.1.11 requires a recipient to reject a JWS whose listed critical extension parameters it does not understand. gose implements no header extensions, so every token carrying a non-empty `crit` should have been rejected — and none were.
• 6.3MediumOct 23, 2026Eclipse KeyPont - GOSECVE-2026-89316`LoadPublicKey` resolved an EC key's curve with an unchecked type assertion, `algToOptsMap[alg].(*ECDSAOptions)`. A JWK declaring `"kty":"EC"` together with a non-EC `"alg"` — which RFC 7517 §4.4 permits — reaches that assertion and **panics**.
• 6.9MediumOct 23, 2026Eclipse KeyPont - GOSECVE-2026-89315`JwtClaims.MarshalJSON` built a Go struct at runtime with `reflect.StructOf`, synthesising a field named `"A" + claimName` for each untyped claim. `reflect.StructOf` **panics** when a field name is not a valid Go identifier, or when it duplicates another field. Both conditions are reachable from ordinary JWT claim names.
• 6.9MediumOct 23, 2026Eclipse KeyPont - GOSECVE-2026-89314`jwkFields.CheckConsistency` detected duplicate `key_ops` entries with a pairwise nested loop, making validation cost grow with the **square** of the entry count. Because the check runs on every JWK and JWKS unmarshal, a modestly sized but hostile JWKS document could occupy a CPU core for many seconds.
• 6.3MediumOct 23, 2026Eclipse KeyPont - GOSECVE-2026-89313`JwksTrustStore.Get` assigned each parsed key to the function's **named return value** while refreshing the JWKS cache. When the requested `kid` was not present, the trailing naked `return` handed the caller the last key in the JWKS document together with a `nil` error — a confidently wrong answer instead of "not found".
• 6.9MediumOct 23, 2026Eclipse KeyPont - GOSECVE-2026-89312`AesGcmCryptor.Open` passed a caller-supplied nonce straight to `cipher.AEAD.Open` without checking its length. The Go standard library **panics** rather than returning an error when a GCM nonce is not exactly `NonceSize()` bytes, so a JWE carrying a wrong-sized IV crashes the decrypting goroutine.
• 8.7HighOct 21, 2026Eclipse OpenJ9 Memory corruptionCVE-2026-110938In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper boundary checks during protocol message and reply handling. An unauthenticated remote attacker or malicious JITServer can transmit malformed network payloads that cause out-of-bounds heap reads, immediately crashing the JITServer daemon or client JVM process via a segmentation fault (SIGSEGV).
• 8.7HighOct 21, 2026Eclipse OpenJ9 Memory corruptionCVE-2026-111075In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled `_size`, `_paddingSize`, and `_dataOffset` fields during `DataDescriptor` message deserialization. An unauthenticated remote attacker can send a crafted network payload that triggers an unsigned integer underflow in `DataDescriptor::getPayloadSize()` and `DataDescriptor::getNextDescriptor()`. This results in an out-of-bounds heap read and an immediate process crash (
• 8.7HighOct 21, 2026Eclipse OpenJ9 Memory corruptionCVE-2026-111074In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remote denial of service. When processing the initial 4-byte length field of an incoming TCP connection, an integer overflow in `MessageBuffer::computeRequiredCapacity()` causes the receiving compilation worker thread to enter an infinite loop consuming ~100% CPU. An unauthenticated remote attacker can exploit this by opening a small number of crafted TCP connections to exhaust the entire wo
• 5.9MediumOct 14, 2026Eclipse Vert.xCVE-2026-102479In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers, the canonicalization process interprets well crafted headers as headers of this list, allowing for instance Content-Xength to be interpeted as Content-Length. This can be exploited for request smuggling purpose. The impacted component is io.vertx:vertx-core.
• 6.9MediumJun 29, 2026Eclipse CSI - PIA Crypto / certificateCVE-2026-12616The /v1/upload/sbom endpoint extracts the iss claim from the attacker-supplied JWT with signature verification disabled, then interpolates that string into three log statements before any validation gate. Because the configured log format ("%(asctime)s - %(name)s - %(levelname)s - %(message)s") renders newlines literally, an unauthenticated attacker can forge log records that are byte-for-byte indistinguishable from PIA's genuine "Successfully authenticated project" message. PIA is an authentica
• 9.4CriticalNov 18, 2025Eclipse Foundation JerseyCVE-2025-12383In Eclipse Jersey versions 2.45, 3.0.16, 3.1.9 a race condition can cause ignoring of critical SSL configurations - such as mutual authentication, custom key/trust stores, and other security settings. This issue may result in SSLHandshakeException under normal circumstances, but under certain conditions, it could lead to unauthorized trust in insecure servers (see PoC)
• 6.0MediumJul 21, 2025Eclipse Foundation Jakarta MailCVE-2025-7962In Jakarta Mail versions prior to 2.0.2 it is possible to perform an SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages.
• 7.2HighMay 8, 2025Eclipse Foundation Jetty Denial of serviceCVE-2024-13009In Eclipse Jetty versions 9.4.0 to 9.4.56 a buffer can be incorrectly released when confronted with a gzip error when inflating a request body. This can result in corrupted and/or inadvertent sharing of data between requests.
• 8.8HighSep 12, 2023Eclipse JGit Path traversal / file handlingCVE-2023-4759Arbitrary File Overwrite in Eclipse JGit <= 6.6.0 In Eclipse JGit, all versions <= 6.6.0.202305301015-r, a symbolic link present in a specially crafted git repository can be used to write a file to locations outside the working tree when this repository is cloned with JGit to a case-insensitive fil2.2% likely

See every Eclipse Foundation entry on the dashboard.

Top products

• Eclipse KeyPont - GOSE9 CVEs in the last year
• Eclipse OpenJ93 CVEs in the last year
• Eclipse ioFog2 CVEs in the last year, 1 critical
• Jersey1 CVE in the last year, 1 critical
• Eclipse Vert.x1 CVE in the last year
• Eclipse KeyPont1 CVE in the last year
• Eclipse CSI - PIA1 CVE in the last year
• Eclipse Che1 CVE in the last year, 1 critical

Advisories

Official advisories from the last 90 days that name this vendor's CVEs.

• oss-security · Oct 28, 2026CVE-2026-102479: Request smuggling in Eclipse Vert.x HTTP/1.x decoderCVE-2026-102479
• Atlassian · Jan 20, 2026Atlassian Security Bulletin January 20, 2026CVE-2025-12383
• Atlassian · Oct 21, 2025Atlassian Security Bulletin October 21, 2025CVE-2025-7962
• Atlassian · Jul 15, 2025Atlassian Security Bulletin July 15, 2025CVE-2024-13009
• Atlassian · May 21, 2024Atlassian Security Bulletin May 21, 2024CVE-2023-4759