Vulnerabilidades en Eclipse Foundation
298 resultadosCVE-2026-19204HIGHA client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memoryEPSS 0.5%CVE-2026-89292CRITICALUnauthenticated SSRF with MNESTIX_BACKEND_API_KEY disclosure in Eclipse Mnestix Browser server actions for configured InfrastructuresEPSS 0.5%CVE-2026-60009HIGHIn Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every filesystem-enabled EPSS 0.4%CVE-2026-90882HIGHReflected arbitrary origins with credentials, allowing cross-origin reads of authenticated user dataEPSS 0.4%CVE-2026-77711HIGHWhen Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication RequiredEPSS 0.4%CVE-2024-7708HIGHFor requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak.
This is particularly the case forEPSS 0.4%CVE-2026-89321MEDIUMPublishing limits the compressed size of a VSIX (ovsx.publishing.max-content-size, 512 MB by default) but nothing limited how large an entryEPSS 0.4%CVE-2026-118488MEDIUMHeap exhaustion via unbounded simple string or bulk string allocation in Vert.x Redis clientEPSS 0.4%CVE-2026-12605CRITICALIn Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin `gfresttoken` to attacker-coEPSS 0.4%CVE-2026-16439MEDIUMEclipse OpenJ9 : Using -Xtrace to trace method arguments can lead to buffer underflowEPSS 0.4%CVE-2026-10051MEDIUMIn Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the EPSS 0.4%CVE-2026-12611HIGHA client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threadsEPSS 0.4%CVE-2023-2597HIGHIn Eclipse Openj9 before version 0.38.0, in the implementation of the shared cache (which is enabled by default in OpenJ9 builds) the size oEPSS 0.4%CVE-2026-18661HIGHIn Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the Jakarta Spec authoritative url-pattern ruEPSS 0.4%CVE-2026-111074HIGHJITServer: Pre-authentication remote Denial of Service via integer overflow infinite loop in MessageBuffer::computeRequiredCapacity()EPSS 0.4%CVE-2026-62927HIGHIn Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculatiEPSS 0.4%CVE-2026-110938HIGHJITServer: Multiple Denial of Service vulnerabilities via out-of-bounds heap reads during message and reply parsingEPSS 0.4%CVE-2024-10917LOWEclipse OpenJ9 might return an incorrect value in JNI function GetStringUTFLengthEPSS 0.4%CVE-2025-55086MEDIUMIn NetXDuo version before 6.4.4, a networking support module for Eclipse Foundation ThreadX, in the DHCPV6 client there was an unchecked indEPSS 0.4%CVE-2026-115215HIGHNetX Secure DTLS server allocates a session for each new source before the cookie exchange and never reclaims it, so spoofed datagrams exhaust the session poolEPSS 0.4%