Eclipse Foundation vulnerabilities
Every vulnerability this feed holds for Eclipse Foundation, merged from five public registers and ordered by what warrants attention first — exploited in the wild, then CVSS, then recency.
9 vulnerabilities tracked.
- 8.8 HmacShaCryptor.Hash never hashed its input.
- 6.9 JweRsaKeyEncryptionDecryptorImpl.Decrypt passed the JWE's initialization vector to cipher.AEAD.Open without checking its length.
- 6.9 JwtClaims.MarshalJSON built a Go struct at runtime with reflect.StructOf, synthesising a field named "A" + claimName for each untyped claim.
- 6.9 jwkFields.CheckConsistency detected duplicate keyops entries with a pairwise nested loop, making validation cost grow with the square of…
- 6.9 AesGcmCryptor.Open passed a caller-supplied nonce straight to cipher.AEAD.Open without checking its length.
- 6.3 JweDirectDecryptorBlock.Decrypt read a 64-bit plaintext length from the thalesaad protected-header field and used it without any validation.
- 6.3 gose parsed the JWS crit header into JwsHeader.Crit and then never read it.
- 6.3 LoadPublicKey resolved an EC key's curve with an unchecked type assertion, algToOptsMap[alg].(ECDSAOptions).
- 6.3 JwksTrustStore.Get assigned each parsed key to the function's named return value while refreshing the JWKS cache.
What this covers
This feed accumulates forward from the day it started storing records, and a name search that finds nothing here is also looked up against the registers directly — so an older advisory resolves even when it predates the corpus. It is still a reading view, not a substitute for the vendor's own advisory, and absence from this page is not a statement that Eclipse Foundation is free of vulnerabilities.
Query this from an agent over MCP · Check a lockfile by version
Other vendors tracked here
Microsoft Red Hat MediaTek, Inc. Apache Software Foundation WAVLINK Gitea Huawei WSO2 Linux Dell Cisco Unknown Citrix n/a Google FFMPEG mathurvishal ag-ui-protocol Plex Jovancoding MONGODB JFrog Hewlett Packard Enterprise (HPE) Adobe