CVE-2026-97402

UNKNOWN 0.0

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

In Eclipse Kura versions 3.1.0 to 5.6.2, the iBeacon and Eddystone advertisement decoders wrongly parse the AD-structure length field of an over-the-air BLE advertising payload. Any unauthenticated attacker within BLE radio range can broadcast a two-byte advertising payload that drives the Kura beacon-scanner thread into a tight infinite loop, pinning a CPU core and permanently halting beacon ingestion until the gateway is restarted. To trigger the attack, the iBeacon/Eddystone scanner component should be installed and active. By default the components are not installed or enabled.

CWE	CWE-835 CWE-194
Vendor	eclipse foundation
Product	eclipse kura
Published	Nov 10, 2026

Stay Ahead of the Next One

Get instant alerts for eclipse foundation eclipse kura

Be the first to know when new unknown vulnerabilities affecting eclipse foundation eclipse kura are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Eclipse Foundation / Eclipse Kura

3.1.0 ≤ 5.6.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/eclipse-kura/kura/security/advisories/GHSA-x83q-g5h7-ffc5 gitlab.eclipse.org: https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/923 gitlab.eclipse.org: https://gitlab.eclipse.org/security/cve-assignment/-/work_items/322

Credits

Eclipse Foundation Security Team