CVE-2026-112186
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
In Eclipse Kura versions 5.4.0 through 5.6.2, the Service Listing V1 REST API read the JSON body of every request into memory, with no limit on its size. The endpoints parse the body before they check whether the caller is authenticated. A remote attacker without valid credentials can therefore send a few dozen large JSON requests at the same time, exhaust the Java heap with an `OutOfMemoryError`, and cause a denial of service. Likewise, a remote attacker, can send a deeply nested JSON request and trigger a `StackOverflowError` because of an unbound recursion in Service Listing V1.
| CWE | CWE-696 CWE-674 CWE-770 |
| Vendor | eclipse foundation |
| Product | eclipse kura |
| Published | Nov 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for eclipse foundation eclipse kura
Be the first to know when new unknown vulnerabilities affecting eclipse foundation eclipse kura are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Eclipse Foundation / Eclipse Kura
5.4.0 ≤ 5.6.2