# Eclipse vulnerabilities

Source: https://junglewise.ai/threats/vendors/eclipse  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/vendors/eclipse.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 133 vulnerabilities in Eclipse: 12 in the last 7 days and 91 in the last 90 days, 11 of them critical and 1 exploited in the wild. The most recent, CVE-2026-97891, was published on 10 November 2026. 52 vulnerabilities in the last four weeks, up 271% on the four before (14). 2 critical against 1. 11 technologies have a page of their own.

## Counts

- Last 7 days: 12
- Last 30 days: 63
- Last 90 days: 91
- All time: 133 (11 critical, 1 exploited in the wild)

## About Eclipse

Eclipse is an open-source integrated development environment and platform for building software tools and applications.

## Latest Eclipse vulnerabilities

- [CVE-2026-97891: Eclipse Kura Web Console session exhaustion denial of service](https://junglewise.ai/threats/cve-2026-97891-in-eclipse-kura-version-5-0-0-to-5-6-2-the-web-console-allocates) (info, published 10 Nov 2026)
- [CVE-2026-97401: Eclipse Kura privilege escalation in CommandCloudApp ZIP extraction](https://junglewise.ai/threats/cve-2026-97401-in-kura-versions-5-6-2-commandcloudapp-execute-extracts-a-caller) (info, published 10 Nov 2026)
- [CVE-2026-112186: Eclipse Kura Service Listing V1 unauthenticated denial of service](https://junglewise.ai/threats/cve-2026-112186-in-eclipse-kura-versions-5-4-0-through-5-6-2-the-service-listing) (info, published 10 Nov 2026)
- [CVE-2026-112185: Eclipse Kura Configuration REST API authorization bypass](https://junglewise.ai/threats/cve-2026-112185-in-eclipse-kura-versions-5-1-0-through-5-6-2-the-configuration) (info, published 10 Nov 2026)
- [CVE-2026-111729: Eclipse Kura path traversal in command file-upload handler](https://junglewise.ai/threats/cve-2026-111729-in-kura-versions-5-6-2-the-command-file-upload-handler-at-post) (info, published 10 Nov 2026)
- [CVE-2026-97402: Eclipse Kura BLE advertisement decoder infinite loop](https://junglewise.ai/threats/cve-2026-97402-in-eclipse-kura-versions-3-1-0-to-5-6-2-the-ibeacon-and-eddystone) (info, published 10 Nov 2026)
- [CVE-2026-112191: Eclipse Kura Identity REST APIs privilege escalation](https://junglewise.ai/threats/cve-2026-112191-in-eclipse-kura-versions-5-4-0-through-5-6-2-the-identity-rest) (info, published 10 Nov 2026)
- [CVE-2026-114359: Eclipse Kura unrestricted deployment package download size](https://junglewise.ai/threats/cve-2026-114359-eclipse-kura-downloads-deployment-packages-dps-from-a-remote-url) (info, published 10 Nov 2026)
- [CVE-2026-113422: Eclipse Kura privilege escalation in Wire Graph update](https://junglewise.ai/threats/cve-2026-113422-in-eclipse-kura-versions-5-0-0-through-5-6-2-the-wire-graph) (info, published 10 Nov 2026)
- [CVE-2026-124683: Eclipse Langium algorithmic complexity DoS in IndentationAwareTokenBuilder](https://junglewise.ai/threats/cve-2026-124683-eclipse-langium-versions-3-2-0-through-4-4-0-contain-an) (info, published 9 Nov 2026)
- [CVE-2026-118492: Eclipse Langium langium-sprotty XSS in diagnostic messages](https://junglewise.ai/threats/cve-2026-118492-in-eclipse-langium-versions-3-0-0-and-later-the-langium-sprotty) (info, published 9 Nov 2026)
- [CVE-2026-123870: Otterdog webhook arbitrary code execution via eval()](https://junglewise.ai/threats/cve-2026-123870-the-otterdog-webapp-evaluates-a-format-string-built-from-the) (info, published 9 Nov 2026)
- [CVE-2026-123059: Eclipse BaSyx Helm Charts cleartext OAuth2 client secret in ConfigMap](https://junglewise.ai/threats/cve-2026-123059-in-eclipse-basyx-helm-charts-version-2-2-0-of-the-aas-basyx-v2) (high, CVSS 7.5, published 5 Nov 2026)
- [CVE-2026-120421: Eclipse Mojarra reflected XSS in URL client window mode](https://junglewise.ai/threats/cve-2026-120421-in-eclipse-mojarra-versions-2-2-0-through-4-0-28-4-1-0-through-4) (medium, CVSS 6.1, published 4 Nov 2026)
- [CVE-2026-118487: Eclipse Vert.x STOMP FrameParser heap exhaustion](https://junglewise.ai/threats/cve-2026-118487-in-eclipse-vert-x-versions-4-0-0-4-5-35-or-5-0-0-5-2-2-the) (high, CVSS 7.5, published 3 Nov 2026)
- [CVE-2026-118489: Eclipse Vert.x CachingWebClient cross-user cache disclosure](https://junglewise.ai/threats/cve-2026-118489-in-eclipse-vert-x-versions-4-0-0-4-5-35-or-5-0-0-5-2-2-when-one) (high, CVSS 7.5, published 3 Nov 2026)
- [CVE-2026-118488: Eclipse Vert.x Redis client unbounded buffer allocation](https://junglewise.ai/threats/cve-2026-118488-in-eclipse-vert-x-versions-4-0-0-4-5-35-or-5-0-0-5-2-2-when-a) (medium, CVSS 5.9, published 3 Nov 2026)
- [CVE-2026-89295: Eclipse Mnestix AAS Generator unbounded memory allocation in ID generation endpoint](https://junglewise.ai/threats/cve-2026-89295-in-eclipse-mnestix-aas-generator-versions-0-1-0-up-until-but) (info, published 3 Nov 2026)
- [CVE-2026-89293: Eclipse Mnestix Browser missing authorization in admin server actions](https://junglewise.ai/threats/cve-2026-89293-in-eclipse-mnestix-browser-versions-1-2-0-up-until-but-excluding) (info, published 3 Nov 2026)
- [CVE-2026-89292: Eclipse Mnestix Browser unauthenticated SSRF with API key disclosure](https://junglewise.ai/threats/cve-2026-89292-in-eclipse-mnestix-browser-versions-1-6-0-up-until-but-excluding) (info, published 3 Nov 2026)
- [CVE-2026-115231: Eclipse ThreadX Module Manager privilege escalation via forged callback](https://junglewise.ai/threats/cve-2026-115231-in-eclipse-threadx-versions-6-0-1-through-6-5-2-202603-the) (info, published 3 Nov 2026)
- [CVE-2026-113421: Eclipse ThreadX Modules use-after-free in trace-buffer callback](https://junglewise.ai/threats/cve-2026-113421-in-eclipse-threadx-versions-6-0-1-through-6-5-2-202603-threadx) (info, published 3 Nov 2026)
- [CVE-2026-115403: Eclipse ThreadX NetX Duo NULL pointer dereference in IPv6 raw socket send](https://junglewise.ai/threats/cve-2026-115403-in-eclipse-threadx-netx-duo-versions-6-0-through-6-5-2-202603a) (info, published 2 Nov 2026)
- [CVE-2026-115215: Eclipse ThreadX NetX Duo DTLS session pool exhaustion](https://junglewise.ai/threats/cve-2026-115215-in-eclipse-threadx-netx-duo-versions-6-0-through-6-5-2-202603a) (info, published 2 Nov 2026)
- [CVE-2026-115654: Eclipse ThreadX Module Manager missing authorization in thread control](https://junglewise.ai/threats/cve-2026-115654-in-eclipse-threadx-versions-6-0-1-through-6-5-2-202603-the) (info, published 2 Nov 2026)

## Most severe Eclipse vulnerabilities

- [CVE-2023-44487: Multiple Vendors HTTP/2 denial of service via Rapid Reset attack](https://junglewise.ai/threats/cve-2023-44487-http-2-rapid-reset-attack-vulnerability) (critical, exploited in the wild, CVSS 5.3, published 10 Oct 2023)
- [CVE-2025-67109: Eclipse Cyclone DDS certificate expiration bypass in authentication plugin](https://junglewise.ai/threats/cve-2025-67109-eclipse-cyclone-dds-certificate-expiration-bypass-in) (critical, CVSS 10, published 23 Dec 2025)
- [CVE-2025-55089: In FileX before 6.4.2, the file support module for Eclipse Foundation ThreadX, there was a possible buffer overflow in…](https://junglewise.ai/threats/cve-2025-55089-in-filex-before-6-4-2-the-file-support-module-for-eclipse) (critical, CVSS 9.8, published 16 Oct 2025)
- [CVE-2025-55086: In NetXDuo version before 6.4.4, a networking support module for Eclipse Foundation ThreadX, in the DHCPV6 client…](https://junglewise.ai/threats/cve-2025-55086-in-netxduo-version-before-6-4-4-a-networking-support-module-for) (critical, CVSS 9.8, published 20 Oct 2025)
- [CVE-2026-114278: Eclipse Che che-machine-exec command injection vulnerability](https://junglewise.ai/threats/cve-2026-114278-the-che-machine-exec-service-constructs-a-shell-command-by) (critical, CVSS 9.8, published 28 Oct 2026)
- [CVE-2026-113620: Eclipse ioFog Controller WebSocket authentication bypass in exec and log routes](https://junglewise.ai/threats/cve-2026-113620-in-eclipse-iofog-controller-versions-3-8-0-through-3-9-1) (critical, CVSS 9.8, published 20 Oct 2026)
- [CVE-2026-24457: Eclipse OpenMQ arbitrary file read via unsafe configuration parsing](https://junglewise.ai/threats/cve-2026-24457-eclipse-openmq-arbitrary-file-read-via-unsafe-configuration) (critical, CVSS 9.1, published 5 Mar 2026)
- [CVE-2025-55100: In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read…](https://junglewise.ai/threats/cve-2025-55100-in-usbx-before-6-4-3-the-usb-support-module-for-eclipse) (critical, CVSS 9.1, published 17 Oct 2025)
- [CVE-2026-78299: Eclipse Embedded CDT path traversal in CMSIS-Pack extraction](https://junglewise.ai/threats/cve-2026-78299-eclipse-embedded-cdt-path-traversal-in-cmsis-pack-extraction) (critical, CVSS 9.1, published 14 Sep 2026)
- [CVE-2025-55081: In Eclipse Foundation NextX Duo before 6.4.4, a module of ThreadX, the _nx_secure_tls_process_clienthello() function…](https://junglewise.ai/threats/cve-2025-55081-in-eclipse-foundation-nextx-duo-before-6-4-4-a-module-of-threadx) (critical, CVSS 9.1, published 15 Oct 2025)

## Vulnerabilities per week

52 vulnerabilities in the last four weeks, up 271% on the four before (14). 2 critical against 1.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 0 | 0 | 0 |
| 24 Aug 2026 | 2 | 0 | 0 |
| 31 Aug 2026 | 7 | 0 | 0 |
| 7 Sep 2026 | 4 | 0 | 0 |
| 14 Sep 2026 | 4 | 1 | 0 |
| 21 Sep 2026 | 1 | 0 | 0 |
| 28 Sep 2026 | 8 | 0 | 0 |
| 5 Oct 2026 | 1 | 0 | 0 |
| 12 Oct 2026 | 19 | 0 | 0 |
| 19 Oct 2026 | 16 | 1 | 0 |
| 26 Oct 2026 | 2 | 1 | 0 |
| 2 Nov 2026 | 15 | 0 | 0 |
| 9 Nov 2026 | 12 | 0 | 0 |

## Eclipse technologies

- [Eclipse ThreadX](https://junglewise.ai/threats/technologies/threadx): 18 vulnerabilities
- [Eclipse Vert.x](https://junglewise.ai/threats/technologies/eclipse-vert-x): 16 vulnerabilities
- [Eclipse Threadx Netx Duo](https://junglewise.ai/threats/technologies/threadx-netx-duo): 16 vulnerabilities
- [Eclipse Kura](https://junglewise.ai/threats/technologies/eclipse-kura): 9 vulnerabilities
- [Eclipse Milo](https://junglewise.ai/threats/technologies/milo): 6 vulnerabilities
- [Eclipse Threadx Usbx](https://junglewise.ai/threats/technologies/threadx-usbx): 6 vulnerabilities
- [Eclipse Openj9](https://junglewise.ai/threats/technologies/openj9): 5 vulnerabilities
- [Eclipse Ankaios](https://junglewise.ai/threats/technologies/ankaios): 4 vulnerabilities
- [Eclipse Che](https://junglewise.ai/threats/technologies/che): 4 vulnerabilities
- [Eclipse Jetty](https://junglewise.ai/threats/technologies/eclipse-jetty): 3 vulnerabilities
- [Eclipse NetX Duo](https://junglewise.ai/threats/technologies/eclipse-netx-duo): 3 vulnerabilities

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Eclipse vulnerabilities", https://junglewise.ai/threats/vendors/eclipse, 13 November 2026.