Threat database

Eclipse Vert.x versions 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0 contain a vulnerability in the vertx-mail-client component. The issue arises because CR (\r) and LF (\n) characters in user-supplied email header names and values are not sanitized before being written into the SMTP DATA section. This allows an attacker controlling these inputs to inject arbitrary email headers or manipulate the message body. Additionally, MIME part metadata fields are also affected by this lack of validation. A secondary weakness permits a bare LF in a From display-name to bypass encoding and be sent unchanged. Exploitation requires the attacker to control header or attachment metadata fields passed to the mail client, such as through a web form or API. The vulnerability has a CVSS 4.0 score of 6.9 (medium severity).

Eclipse Vert.x versions 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0 contain a vulnerability in the HTTP/1.x decoder's header canonicalization process. This flaw causes certain crafted headers, such as 'Content-Xength', to be misinterpreted as standard headers like 'Content-Length'. This vulnerability can be exploited for HTTP request smuggling attacks.

Eclipse Vert.x versions 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0 contain a scope bypass vulnerability in the ChainAuthHandler component of Eclipse Vert.x Web. This vulnerability occurs when ChainAuthHandler is used with scope-requiring authentication handlers such as JWTAuthHandler or OAuth2AuthHandler. If a user is already authenticated by a preceding handler, ChainAuthHandler skips scope validation, allowing access to resources without proper scope checks.

CVE-2026-102476 is a critical vulnerability in Eclipse Vert.x HTTP client versions 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and version 5.2.0. The issue arises because the SSL context cache key does not fully reflect the SSL properties, allowing a client to receive an SSL context with weaker security properties than requested, such as bypassing hostname validation.

CVE-2026-106465 is an authentication bypass vulnerability in the Eclipse Foundation's NetX Duo product. The flaw arises because the DTLS server sends a HelloVerifyRequest with a cookie but does not properly verify the cookie returned by the client. Instead, the server only checks the cookie's length, allowing an attacker to bypass verification by including any single byte in the cookie field. This enables handshake completion without proper source address verification.

An out-of-bounds read vulnerability exists in Eclipse Foundation NetX Duo in the function _nx_secure_x509_parse_signature_data. The function calculates the certificate signature length without verifying that the length is non-zero, leading to a potential read past the buffer when parsing a certificate with an empty ASN.1 BIT STRING signature. This occurs during the TLS handshake with remote, unauthenticated input.

CVE-2026-103415 is a critical out-of-bounds write vulnerability in the Eclipse Foundation's NetX Duo TLS 1.3 client implementation. When processing a HelloRetryRequest, the client copies the server's cookie into the second ClientHello message without verifying that the cookie fits within the allocated packet buffer. This flaw allows a malicious or compromised server to overwrite memory beyond the intended buffer before certificate authentication completes. Only the client-side TLS path is affected.

CVE-2026-103414 is a high-severity out-of-bounds write vulnerability in the Eclipse Foundation's GUIX binary resource (theme) loader. The vulnerability arises because the loader uses two separate passes with independent cursor arithmetic to size and populate its memory arena, but does not validate the size field `gx_page_header_data_size` against the actual glyph data. This leads to a mismatch in glyph counts and causes the loader to write beyond the allocated buffer, using content directly from the resource file. The vulnerable buffer is internally allocated by GUIX, and the public API does not allow caller control over the size, making it impossible for callers to prevent this overflow. This issue affects versions from 0 up to and including 6.5.1.202602a and is present in the default configuration where `GX_BINARY_RESOURCE_SUPPORT` is enabled.

CVE-2026-92877 is a high-severity vulnerability in the Eclipse Foundation's jaxb-ri (core) component. It involves XML External Entity (XXE) injection due to reliance solely on the FEATURE_SECURE_PROCESSING flag to prevent external entity resolution. On some JAXP implementations where this feature does not fully block external entity resolution, attackers can exploit untrusted XML unmarshalling to read local files via out-of-band XXE.

Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cache writes past it and on into the rest of the session control block, which holds pointers. A malicious or compromised server can make a TLS 1.3 client produce such a message before certificate authentication completes, so no server certificate is needed to reach it.

Eclipse Che versions 7.29.0 and later contain a vulnerability in the GET /api/scm/resolve and POST /api/factory/resolver endpoints that allows authenticated users to supply attacker-controlled URLs to a fetch function without proper scheme or host validation. This enables reading arbitrary local files, accessing internal HTTP services and cloud metadata endpoints, and forwarding stored SCM personal access tokens to attacker-controlled hosts. The vulnerability also allows exfiltration of SCM personal access tokens via malicious devfiles. No fix is currently available.

In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's `Authorization` header to outgoing requests without checking the destination origin. In deployments using authentication, an attacker could induce a user to open a crafted Web UI link whose `aas` or `path` query parameter points to an attacker-controlled endpoint. The user's browser would then send the configured Basic Authentication credentials, Bearer token, or an available OAuth2 access token to that endpoint. The attacker could reuse the disclosed credential to access protected AAS services with the victim's privileges. The issue is fixed in v2-260924.

CVE-2026-102717 is a high-severity vulnerability in Eclipse Foundation's NetX Duo affecting versions 6.4.4 through 6.5.1.202602. It involves an out-of-bounds read caused by an MQTT WebSocket setter ABI mismatch, which may lead to memory disclosure or application crashes.

Mounting an attacker-controlled NAND flash image (`lx_nand_flash_open()`) triggers an unbounded out-of-bounds heap **write** in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full 8-byte attacker-chosen value (register-verified). Two accompanying OOB reads. All reproduced verbatim under ASan at HEAD `9f1cfdc`. (The affected metadata-parser header states "Some portions generated by Copilot (Sonnet 4.6)" — an AI-generated parser with an unchecked on-flash count.)

`gx_binres_theme_load()` sizes its theme buffer for the theme it was asked for, and allocates it even when the resource holds no theme with that id. A theme id at or past the theme count declared by the resource gets a buffer of zero bytes. The load pass then walks past the end of the theme table, takes whatever follows as a theme header, and writes a `GX_THEME` and its tables into that zero-byte buffer.

FTP Passive Data Connection Not Bound to the Authenticated Control Peer

CVE-2026-102728 is a high-severity buffer over-read vulnerability in the Eclipse Foundation's NetX Duo library. It affects two client-side TLS/DTLS handshake parsers that read server-supplied message fields before verifying the message length, leading to out-of-bounds reads. This flaw occurs when a TLS or DTLS client connects to a malicious or malformed server. The vulnerability has a CVSS score of 7.5, indicating significant confidentiality impact but no integrity or availability impact. Affected versions include all NetX Duo releases up to and including 6.5.1.202602.

Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read

Out-of-bounds Read from Unvalidated MSRP Attribute List Length

NULL Pointer Dereference When Evicting the Sole MSRP Attribute