CVE-2026-89295
Unauthenticated memory-exhaustion denial of service in Eclipse Mnestix AAS Generator unbounded count parameter
In Eclipse Mnestix AAS Generator versions 0.1.0 up until but excluding 1.5.0, a practical upper bound on the client-supplied count parameter of the GET /api/v1/IdGenerator/submodelIds/{count} and GET /api/v2/IdGenerator/submodelIds/{count} endpoints is not enforced. The service generates and retains identifiers in memory before returning a response. A remote unauthenticated attacker can submit a large count to cause excessive memory consumption, potentially resulting in denial of service. Exploitation requires network access to the endpoint and successful retrieval of the ID-generation configuration from the configured backend repository.
| CWE | CWE-770 |
| Vendor | eclipse foundation |
| Product | eclipse mnestix |
| Published | Nov 3, 2026 |
Get instant alerts for eclipse foundation eclipse mnestix
Be the first to know when new unknown vulnerabilities affecting eclipse foundation eclipse mnestix are published — delivered to Slack, Telegram or Discord.