Time-of-check time-of-use race condition in Eclipse OMR
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Prior to 0.1, all builds of Eclipse OMR contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop by versioning - for example if there is a condition that is moved out of the loop that reads a field we may not privatize the value of that field in the modified copy of the loop allowing the test to see one value of the field and subsequently the loop to see a modified field value without retesting the condition moved out of the loop. This can lead to a variety of different issues but read out of array bounds is one major consequence of these problems.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Eclipse Foundation | Eclipse OMR | before 0.1 | 0.1 | Patch available | CNA |
- Eclipse OMR VendorEclipse Foundation Affected before 0.1 Fixed in 0.1 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eclipse:omr:*:*:*:*:*:*:*:* | before 0.1 | Vulnerable | Eclipse Foundation |
- cpe:2.3:a:eclipse:omr:*:*:*:*:*:*:*:* Versions before 0.1 Vulnerable ·Eclipse Foundation
Remediation
- Fix · CNA Eclipse OMR (The Eclipse Foundation) Fixed in 0.1
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
The Eclipse Foundation Eclipse OMR 0.1
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2019-08830 Access control flaw in Eclipse OMRPriority LOW 34
Timeline
- 2026-10-02 Threatist record created from CVE-2019-11774
- 2026-10-03 Alias added: GHSA-c4qj-5gg4-8hwf
References
More Eclipse Foundation Omr vulnerabilities
- TI-2026-00915 Buffer overflow in Eclipse OMR CVSS 4.0MEDIUM 6.9
- TI-2025-13291 OMR on Z processors Exposing a possible buffer over-read problem CVSS 4.0MEDIUM 6.9
- TI-2019-08830 Access control flaw in Eclipse OMR CVSS 3.1HIGH 7.8
- TI-2025-01264 Eclipse OMR: Buffer overflow vulnerability CVSS 4.0HIGH 7.1
- TI-2026-13582 Eclipse OMR : arraycmp SIMD implementation does not check if the number of bytes to compare is zero CVSS 4.0MEDIUM 5.7
- TI-2025-01263 Eclipse OMR: Null pointer dereference vulnerability CVSS 4.0MEDIUM 5.1
Sources
- CVE-2019-11774 · CVE Program
- CVE-2019-11774 · NVD
- FIRST EPSS
- GHSA-c4qj-5gg4-8hwf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences