Eclipse vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2023-54344 Eclipse Equinox OSGi 3.7.2 and earlier contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by senCritical 9.3 · May 5, 2026
• CVE-2023-54342 Eclipse Equinox OSGi versions 3.8 through 3.18 contain a remote code execution vulnerability in the console interface that allows unauthenticated attackers to eCritical 9.3 · May 5, 2026
• CVE-2025-67109 Improper verification of the time certificate in Eclipse Cyclone DDS before v0.10.5 allows attackers to bypass certificate checks and execute commands with SystCritical 10 · Dec 23, 2025
• CVE-2023-5632 In Eclipse Mosquito before and including 2.0.5, establishing a connection to the mosquitto server without sending data causes the EPOLLOUT event to be added, whHigh 7.5 · Oct 18, 2023
• CVE-2023-36478 Eclipse Jetty provides a web server and servlet container.High 7.5 · Oct 10, 2023
• CVE-2023-28366 The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with dupliHigh 7.5 · Sep 1, 2023
• CVE-2015-8031 Hudson (aka org.jvnet.hudson.main:hudson-core) before 3.3.2 allows XXE attacks.Critical 9.8 · Jul 18, 2022
• CVE-2021-41040 In Eclipse Wakaama, ever since its inception until 2021-01-14, the CoAP parsing code does not properly sanitize network-received data.High 7.5 · Feb 1, 2022
• CVE-2021-32835 Eclipse Keti is a service that was designed to protect RESTfuls API using Attribute Based Access Control (ABAC).Critical 9.9 · Sep 8, 2021
• CVE-2021-32834 Eclipse Keti is a service that was designed to protect RESTfuls API using Attribute Based Access Control (ABAC).High 8.2 · Sep 8, 2021
• CVE-2020-18735 A heap buffer overflow in /src/dds_stream.c of Eclipse IOT Cyclone DDS Project v0.1.0 causes the DDS subscriber server to crash.High 7.5 · Aug 23, 2021
• CVE-2020-18734 A stack buffer overflow in /ddsi/q_bitset.h of Eclipse IOT Cyclone DDS Project v0.1.0 causes the DDS subscriber server to crash.High 7.5 · Aug 23, 2021
• CVE-2020-35217 Vert.x-Web framework v4.0 milestone 1-4 does not perform a correct CSRF verification.High 8.8 · Jan 20, 2021
• CVE-2020-14368 A flaw was found in Eclipse Che in versions prior to 7.14.0 that impacts CodeReady Workspaces.High 7.1 · Dec 14, 2020
• CVE-2009-5045 Dump Servlet information leak in jetty before 6.1.22.High 7.5 · Nov 6, 2019
• CVE-2019-9004 In Eclipse Wakaama (formerly liblwm2m) 1.0, core/er-coap-13/er-coap-13.c in lwm2mserver in the LWM2M server mishandles invalid options, leading to a memory leakHigh 7.5 · Feb 22, 2019
• CVE-2018-20227 RDF4J 2.4.2 allows Directory Traversal via ../ in an entry in a ZIP archive.High 7.5 · Dec 19, 2018
• CVE-2018-20145 Eclipse Mosquitto 1.5.x before 1.5.5 allows ACL bypass: if the option per_listener_settings was set to true, and the default listener was in use, and the defaulHigh 7.5 · Dec 13, 2018
• CVE-2018-1000644 Eclipse RDF4j version < 2.4.0 Milestone 2 contains a XML External Entity (XXE) vulnerability in RDF4j XML parser parsing RDF files that can result in the discloCritical 10 · Aug 20, 2018
• CVE-2018-14371 The getLocalePrefix function in ResourceManager.java in Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc parameter.High 7.5 · Jul 18, 2018
• CVE-2017-9735 Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapseHigh 7.5 · Jun 16, 2017
• CVE-2016-4800 The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrCritical 9.8 · Apr 13, 2017
• CVE-2017-7243 Eclipse tinydtls 0.8.2 for Eclipse IoT allows remote attackers to cause a denial of service (DTLS peer crash) by sending a "Change cipher spec" packet without pHigh 7.5 · Mar 24, 2017