Adoptium Temurin
Monthly
URL validation bypass on the Eclipse Adoptium website (adoptium.net) lets an unauthenticated attacker craft a post-download link that passes the site's trusted-prefix check but resolves - after the browser's RFC 3986 dot-segment normalisation - to an arbitrary attacker-controlled repository, so a victim sees the genuine "Thank you for downloading Eclipse Temurin" page while their browser fetches a binary of the attacker's choosing. Every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (2026-09-24) is affected; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, meaning exploitation depends on a victim following a crafted adoptium.net link (typically via phishing) and then executing the downloaded file, so the integrity impact is real but user-interaction-gated. There is no public exploit identified at time of analysis and EPSS is very low (0.11%, 1st percentile), the vendor fix is available, and the advisory is public under GHSA-f228-m952-5r6w - a real but non-urgent issue whose exposure window has already closed on the hosted site.
URL validation bypass on the Eclipse Adoptium website (adoptium.net) lets an unauthenticated attacker craft a post-download link that passes the site's trusted-prefix check but resolves - after the browser's RFC 3986 dot-segment normalisation - to an arbitrary attacker-controlled repository, so a victim sees the genuine "Thank you for downloading Eclipse Temurin" page while their browser fetches a binary of the attacker's choosing. Every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (2026-09-24) is affected; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, meaning exploitation depends on a victim following a crafted adoptium.net link (typically via phishing) and then executing the downloaded file, so the integrity impact is real but user-interaction-gated. There is no public exploit identified at time of analysis and EPSS is very low (0.11%, 1st percentile), the vendor fix is available, and the advisory is public under GHSA-f228-m952-5r6w - a real but non-urgent issue whose exposure window has already closed on the hosted site.