CVE-2025-55098

Potential out-of-bounds read in _ux_host_class_audio_device_type_get()

In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _ux_host_class_audio_device_type_get() when parsing a descriptor of an USB audio device.

CVSS 4.0 · 1 Low EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Threadx Usbx Usbx

CVE-2025-55099

Potential out-of-bounds read in _ux_host_class_audio_alternate_setting_locate()

In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _ux_host_class_audio_alternate_setting_locate() when parsing a descriptor with attacker-controlled frequency fields.

CVSS 4.0 · 2.4 Low EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Threadx Usbx Usbx

CVE-2025-55097

Potential out-of-bounds read in _ux_host_class_audio_streaming_sampling_get()

In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _ux_host_class_audio_streaming_sampling_get() when parsing a descriptor of an USB streaming device.

CVSS 4.0 · 2.4 Low EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Threadx Usbx Usbx

CVE-2025-55096

Inadequate bounds check and potential underflow in _ux_host_class_hid_report_descriptor_get()

In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _ux_host_class_hid_report_descriptor_get()  when parsing a descriptor of an USB HID device.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Threadx Netx Duo Threadx Usbx

CVE-2025-55079

Missing check for thread priority

In Eclipse ThreadX before version 6.4.3, the thread module has a setting of maximum priority. In some cases the check of that maximum priority wasn't performed, allowing, as a result, to obtain a thread with higher priority than expected and causing a possible denial of service.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Threadx

CVE-2025-55080

Improper Parameter Check in ThreadX Syscall Implementation

In Eclipse ThreadX before 6.4.3, when memory protection is enabled, syscall parameters verification wasn't enough, allowing an attacker to obtain an arbitrary memory read/write.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Threadx

CVE-2025-55078

Incomplete validation of kernel object pointers in system calls

In Eclipse ThreadX before version 6.4.3, an attacker can cause a denial of service (crash) by providing a pointer to a reserved or unmapped memory region. Vulnerable system calls had a check of pointers, but that check wasn't verifying whether the pointer is outside the module memory region.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Threadx

CVE-2025-55091

Potential out of bound read in _nx_ip_packet_receive()

In NetX Duo before 6.4.4, the networking support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _nx_ip_packet_receive() function when received an Ethernet with type set as IP but no IP data.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Threadx Netx Duo

CVE-2025-55090

Potential out of bound read issue in _nx_ipv4_packet_receive() in NetX Duo

In NetX Duo before 6.4.4, the networking support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _nx_ipv4_packet_receive() function when received an Ethernet frame with less than 4 bytes of IP packet.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Threadx Netx Duo

CVE-2025-55084

Out of bound read in _nx_secure_tls_proc_clienthello_supported_versions_extension()

In NetX Duo version before 6.4.4, the component of Eclipse Foundation ThreadX, there was an incorrect bound check in_nx_secure_tls_proc_clienthello_supported_versions_extension() in the extension version field.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Threadx Netx Duo

CVE-2025-55082

Potential out of bound read and info leak in_nx_secure_tls_psk_identity_find()

In NetX Duo version before 6.4.4, the component of Eclipse Foundation ThreadX, there was a potential out of bound read in _nx_secure_tls_process_clienthello() because of a missing validation of PSK length provided in the user message.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Threadx Netx Duo

CVE-2024-43787

Hono CSRF middleware can be bypassed using crafted Content-Type header

Hono is a Web application framework that provides support for any JavaScript runtime. Hono CSRF middleware can be bypassed using crafted Content-Type header. MIME types are case insensitive, but isRequestedByFormElementRe only matches lower-case. As a result, attacker can bypass csrf middleware using upper-case form-like MIME type. This vulnerability is fixed in 4.5.8.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Eclipse Hono

Products

Hono Hono

CVE-2025-4447

Buffer Overflow in Eclipse OpenJ9

In Eclipse OpenJ9 versions up to 0.51, when used with OpenJDK version 8 a stack based buffer overflow can be caused by modifying a file on disk that is read when the JVM starts.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Eclipse Redhat

Products

Openj9 Enterprise Linux

CVE-2021-28165

jetty: Resource exhaustion when receiving an invalid large TLS frame

In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.

CVSS 3.1 · 7.5 High EPSS 53.9% KEV · Not listed

Vendors

Eclipse Jenkins Netapp and 2 more

Products

Jetty Jenkins Cloud Manager and 25 more

CVE-2020-27223

jetty: request containing multiple Accept headers with a large number of "quality" parameters may lead to DoS

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values.

CVSS 3.1 · 5.2 Medium EPSS 78.0% KEV · Not listed

Vendors

Apache Debian Eclipse and 3 more

Products

Nifi Solr Spark and 19 more

CVE-2025-2258

Eclipse ThreadX NetX Duo HTTP server single PUT request integer underflow

In NetX Duo component HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.3, an attacker can cause an integer underflow and a subsequent denial of service by writing a very large file, by specially crafted packets with Content-Length smaller than the data request size. A possible workaround is to disable HTTP PUT support. This issue follows an uncomplete fix in CVE-2025-0728.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Threadx Netx Duo

CVE-2025-2259

Eclipse ThreadX NetX Duo component HTTP server single PUT request integer underflow

In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.3, an attacker can cause an integer underflow and a subsequent denial of service by writing a very large file, by specially crafted packets with Content-Length in one packet smaller than the data request size of the other packet. A possible workaround is to disable HTTP PUT support. This issue follows an incomplete fix of CVE-2025-0727

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Threadx Netx Duo

CVE-2024-10838

Integer Underflow in DDS_Security_Deserialize_ methods may lead to OOB read

An integer underflow during deserialization may allow any unauthenticated user to read out of bounds heap memory. This may result into secret data or pointers revealing the layout of the address space to be included into a deserialized data structure, which may potentially lead to thread crashes or cause denial of service conditions.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Cyclone Data Distribution Service

CVE-2025-0728

Eclipse ThreadX NetX Duo HTTP server single PUT request integer underflow

In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.2, an attacker can cause an integer underflow and a subsequent denial of service by writing a very large file, by specially crafted packets with Content-Length smaller than the data request size. A possible workaround is to disable HTTP PUT support.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Threadx Netx Duo

CVE-2025-0727

Eclipse ThreadX NetX Duo HTTP server single PUT request integer underflow

In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.2, an attacker can cause an integer underflow and a subsequent denial of service by writing a very large file, by specially crafted packets with Content-Length in one packet smaller than the data request size of the other packet. A possible workaround is to disable HTTP PUT support.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Threadx Netx Duo