Eclipse Foundation vulnerabilities
Published CVEs affecting Eclipse Foundation products: 188 record(s), with severity, exploitation and fixes.
NetX Duo 33Vert.x 21Threadx Netx Duo 18Jetty 16Theia 12Threadx 6Threadx Usbx 6Milo 6Glassfish 5Eclipse Ankaios 4Open Vsx 4USBX 4Eclipse aeriOS 4Openj9 4Eclipse Ditto 3Org.eclipse.jetty:jetty-security 3Eclipse Connected Services Platform 3Eclipse CSI - PIA 3Omr 3Eclipse Arrowhead 2Org.eclipse.jetty.ee10:jetty-ee10-servlet 2Org.eclipse.jetty.ee11:jetty-ee11-servlet 2GUIX 2Org.eclipse.jetty.ee9:jetty-ee9-security 2Org.eclipse.jetty.ee8:jetty-ee8-security 2Eclipse BaSyx 2Equinox OSGi 2NextX Duo 2Openmq 2Eclipse Che 2Eclipse KUKSA - Databroker 2Eclipse Jetty - EE9 1Eclipse BaSyx Go Components 1Eclipse Jetty - EE8 1Hawkbit 1Eclipse-hawkbit/hawkbit 1Eclipse BaSyx - Java Server SDK 1eclipse-threadx/levelx(NAND driver) 1Mojarra 1Accessibility Tools Framework 1
CVE-2025-55093
Medium · 5.3
CWE-125 Oct 17, 2025
Out of bound read and write in _nx_ipv4_packet_receive() when handling unicast DHCP messages
In NetX Duo before 6.4.4, the networking support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _nx_ipv4_packet_receive() when handling unicast DHCP messages that could cause corruption of 4 bytes of memory.
CVE-2025-55092
Medium · 5.3
CWE-125 Oct 17, 2025
Potential out of bound read in _nx_ipv4_option_process()
In Eclipse Foundation NetX Duo before 6.4.4, the networking support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _nx_ipv4_option_process() when processing an IPv4 packet with the timestamp option.
CVE-2025-55091
Medium · 6.5
CWE-125 Oct 16, 2025
Potential out of bound read in _nx_ip_packet_receive()
In NetX Duo before 6.4.4, the networking support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _nx_ip_packet_receive() function when received an Ethernet with type set as IP but no IP data.
CVE-2025-55090
Medium · 6.5
CWE-125 Oct 16, 2025
Potential out of bound read issue in _nx_ipv4_packet_receive() in NetX Duo
In NetX Duo before 6.4.4, the networking support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _nx_ipv4_packet_receive() function when received an Ethernet frame with less than 4 bytes of IP packet.
CVE-2025-55089
Critical · 9.8
CWE-119 Oct 16, 2025
Eclipse ThreadX FileX RAM disk driver buffer overflow
In FileX before 6.4.2, the file support module for Eclipse Foundation ThreadX, there was a possible buffer overflow in the FileX RAM disk driver. It could cause a remote execurtion after receiving a crafted sequence of packets
CVE-2025-55084
Medium · 5.3
CWE-126 Oct 16, 2025
Out of bound read in _nx_secure_tls_proc_clienthello_supported_versions_extension()
In NetX Duo version before 6.4.4, the component of Eclipse Foundation ThreadX, there was an incorrect bound check in_nx_secure_tls_proc_clienthello_supported_versions_extension() in the extension version field.
CVE-2025-55083
Medium · 5.3
CWE-126 Oct 15, 2025
Broken bounds check in Broken bounds check in _nx_secure_tls_process_clienthello_psk_extension()
In NetX Duo version before 6.4.4, the component of Eclipse Foundation ThreadX, there was an incorrect bound check resulting it out by two out of bound read.
CVE-2025-55082
Medium · 5.3
CWE-125 Oct 15, 2025
Potential out of bound read and info leak in_nx_secure_tls_psk_identity_find()
In NetX Duo version before 6.4.4, the component of Eclipse Foundation ThreadX, there was a potential out of bound read in _nx_secure_tls_process_clienthello() because of a missing validation of PSK length provided in the user message.
CVE-2025-55081
Critical · 9.1
CWE-125 Oct 15, 2025
Potential out of bound read in _nx_secure_tls_process_clienthello()
In Eclipse Foundation NextX Duo before 6.4.4, a module of ThreadX, the _nx_secure_tls_process_clienthello() function was missing length verification of
certain SSL/TLS client hello message: the ciphersuite length and
compression method length. In case of an attacker-crafted message with
values outside of the expected range, it could cause an out-of-bound
read.
CVE-2025-55080
High · 7.1
CWE-233 Oct 15, 2025
Improper Parameter Check in ThreadX Syscall Implementation
In Eclipse ThreadX before 6.4.3, when memory protection is enabled, syscall parameters verification wasn't enough, allowing an attacker to obtain an arbitrary memory read/write.
CVE-2025-55079
Medium · 5.5
CWE-770 Oct 15, 2025
Missing check for thread priority
In Eclipse ThreadX before version 6.4.3, the thread module has a setting of maximum priority. In some cases the check of that maximum priority wasn't performed, allowing, as a result, to obtain a thread with higher priority than expected and causing a possible denial of service.
CVE-2025-55078
Medium · 5.5
CWE-233 Oct 14, 2025
Incomplete validation of kernel object pointers in system calls
In Eclipse ThreadX before version 6.4.3, an attacker can cause a denial of service (crash) by providing a pointer to a reserved or unmapped memory region. Vulnerable system calls had a check of pointers, but that check wasn't verifying whether the pointer is outside the module memory region.
CVE-2023-44487
High · 7.5
KEV Urgent · 73 Public exploit CWE-400 Oct 10, 2023
HTTP/2 Rapid Reset Attack Vulnerability
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.