Eclipse Foundation Eclipse Glassfish vulnerabilities

CVE-2026-24457 [CRITICAL] CWE-22 CVE-2026-24457: An unsafe parsing of OpenMQ's configuration in OpenMQ versions <6.5.2 and <6.9.0, allows a remote at An unsafe parsing of OpenMQ's configuration in OpenMQ versions <6.5.2 and <6.9.0, allows a remote attacker to read arbitrary files from a MQ Broker's server. A full exploitation could read unauthorized files of the OpenMQ’s host OS. In some scenarios RCE could be achieved. This is fixed in OpenMQ 6.5.2, 6.9.0, and in GlassFish 7.0.26, 7.1.1, and 8.

CVE-2026-2587 [CRITICAL] CWE-917 CVE-2026-2587: A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rend A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The application processes .xml files and evaluates user-supplied values within a context where Expression Language (EL) “expressions” are processed without proper sanitization or escaping. By injec

CVE-2026-2586 [CRITICAL] CWE-94 CVE-2026-2586: An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administrat An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user with access to the panel can send crafted requests that allow the execution of arbitrary operating system commands with the privileges of the application service user. This issue affects Eclipse GlassFish: from 8.0.0 to 8.0.1, fixed

CVE-2024-9408 [CRITICAL] CWE-918 CVE-2024-9408: In Eclipse GlassFish since version 6.2.5 it is possible to perform a Server Side Request Forgery att In Eclipse GlassFish since version 6.2.5 it is possible to perform a Server Side Request Forgery attack in specific endpoints.

CVE-2026-12605 [CRITICAL] CWE-918 CVE-2026-12605: In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leak In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin `gfresttoken` to attacker-controlled host if the victim is authenticated into the Admin Console -\> full unauthenticated takeover of Eclipse GlassFish domain until the token expires.

CVE-2024-9342 [CRITICAL] CWE-307 CVE-2024-9342: In Eclipse GlassFish version 7.0.16 or earlier it is possible to perform Login Brute Force attacks a In Eclipse GlassFish version 7.0.16 or earlier it is possible to perform Login Brute Force attacks as there is no limitation in the number of failed login attempts.

CVE-2023-41080 [MEDIUM] CWE-601 CVE-2023-41080: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apa URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92. Older, EOL versions may also be affected. The vulnerability is limited to the

CVE-2026-12606 [MEDIUM] CWE-444 CVE-2026-12606: Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed tra Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header's line, which can be leveraged to perform HTTP request smuggling. Grizzly 5.0.1 supports system properties that enable the behavior that fixes the vulnerability - set org.glassfish.grizzly.http.STRICT_HEADER_NAME_VALIDATION_RFC_9110 and or

CVE-2024-9343 [MEDIUM] CWE-79 CVE-2024-9343: In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting attacks in th In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting attacks in the Administration Console.

CVE-2024-10032 [MEDIUM] CWE-79 CVE-2024-10032: In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting attacks in th In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting attacks in the Administration Console.

CVE-2024-10031 [MEDIUM] CWE-79 CVE-2024-10031: In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site Scripting attacks by mo In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site Scripting attacks by modifying the configuration file in the underlying operating system.

CVE-2024-10029 [MEDIUM] CWE-79 CVE-2024-10029: In Eclipse GlassFish version 7.0.15 is possible to perform Reflected Cross-site scripting attacks in In Eclipse GlassFish version 7.0.15 is possible to perform Reflected Cross-site scripting attacks in the Administration Console.