CVSS 8.7 (high) · published 2026-11-10
In Eclipse Kura versions 5.4.0 through 5.6.2, the Service Listing V1 REST API read the JSON body of every request into memory, with no limit on its size. The endpoints parse the body before they check whether the caller is authenticated. A remote attacker without valid credentials can therefore send a few dozen large JSON requests at the same time, exhaust the Java heap with an `OutOfMemoryError`, and cause a denial of service. Likewise, a remote attacker, can send a deeply nested JSON request and trigger a `StackOverflowError` because of an unbound recursion in Service Listing V1.
Weakness: CWE-674, CWE-696, CWE-770
Source: NVD CVE-2026-112186
Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.