ECLIPSE KURA · CVE-2026-112186 · Package
FIX → 5.6.3
Eclipse Kura's Service Listing V1 REST API reads every request body fully into memory before checking authentication, with no size limit. A remote attacker without credentials can exhaust the Java heap or trigger a stack overflow with deeply nested JSON, causing a denial of service.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems running Eclipse Kura 5.4.0 through 5.6.2 with the Service Listing V1 REST API reachable over the network. The body is parsed before authentication, so the flaw is exposed to any remote caller who can reach the endpoint. Gateways where the API is blocked from untrusted networks are less exposed, but the sources do not say how to confirm that.
Not affected if default-config
Who cares eclipse-kura, iot-gateway, java
Upgrade to 5.6.3
5.6.3 (released 2026-11-09)In Eclipse Kura versions 5.4.0 through 5.6.2, the Service Listing V1 REST API read the JSON body of every request into memory, with no limit on its size. The endpoints parse the body before they check whether the caller is authenticated. A remote attacker without valid credentials can therefore send a few dozen large JSON requests at the same time, exhaust the Java heap with an OutOfMemoryError, and cause a denial of service. Likewise, a remote attacker, can send a deeply nested JSON request and trigger a StackOverflowError because of an unbound recursion in Service Listing V1.
This page as .md ·
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.