{"id":"CVE-2026-112186","kind":"vulnerability","aliases":["CVE-2026-112186"],"related":[],"title":"Eclipse Kura: unauthenticated JSON requests can crash the Service Listing API","description":"In Eclipse Kura versions 5.4.0 through 5.6.2, the Service Listing V1 REST API read the JSON body of every request into memory, with no limit on its size. The endpoints parse the body before they check whether the caller is authenticated. A remote attacker without valid credentials can therefore send a few dozen large JSON requests at the same time, exhaust the Java heap with an `OutOfMemoryError`, and cause a denial of service. Likewise, a remote attacker, can send a deeply nested JSON request and trigger a `StackOverflowError` because of an unbound recursion in Service Listing V1.","summary":"Eclipse Kura's Service Listing V1 REST API reads every request body fully into memory before checking authentication, with no size limit. A remote attacker without credentials can exhaust the Java heap or trigger a stack overflow with deeply nested JSON, causing a denial of service.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Eclipse Kura","fixed":["5.6.3"],"affected":">= 5.4.0, <= 5.6.2","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["eclipse-kura","iot-gateway","java","package"],"not_affected_if":["default-config"],"how_to_check":"- Check the installed Kura version; 5.4.0 through 5.6.2 is affected, 5.6.3 contains the fix.\n- Check whether the Kura REST service (Service Listing V1, org.eclipse.kura.rest.service.listing.provider) is installed and its HTTP/HTTPS port is reachable from untrusted networks.\n- Until upgraded, block or firewall the Kura REST port from untrusted networks.","fix":"Upgrade Eclipse Kura to 5.6.3 (released 2026-11-09). Release notes: permission checks now run before the request body is read, request body capped to 64 KiB on the relevant REST APIs, and property filter nesting depth limited in rest.service.listing.provider.","status":"open","published_at":"2026-11-10T17:17:20+00:00","first_seen_at":"2026-11-10T17:22:40+00:00","triaged_at":"2026-11-10T17:23:49+00:00","updated_at":"2026-11-10T17:27:21+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-10T17:23:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Eclipse Kura: unauthenticated JSON requests can crash the Service Listing API","impact":"low","summary":"Eclipse Kura's Service Listing V1 REST API reads every request body fully into memory before checking authentication, with no size limit. A remote attacker without credentials can exhaust the Java heap or trigger a stack overflow with deeply nested JSON, causing a denial of service.","audience":"businesses","category":"package","nicknames":[],"who_cares":["eclipse-kura","iot-gateway","java"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote caller crashes the service with memory exhaustion or stack overflow","analyst_note":"Read the vendor advisory linked in the sources to confirm the fixed version and whether the endpoint is on by default.","how_to_check":"- Check the Kura version installed on the gateway and see whether it falls in `5.4.0` through `5.6.2`\n- Look for the Service Listing V1 REST API being reachable from the network","plain_action":"","product_name":"Eclipse Kura","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Systems running Eclipse Kura 5.4.0 through 5.6.2 with the Service Listing V1 REST API reachable over the network. The body is parsed before authentication, so the flaw is exposed to any remote caller who can reach the endpoint. Gateways where the API is blocked from untrusted networks are less exposed, but the sources do not say how to confirm that.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000767,"input_tokens":4681,"output_tokens":597,"severity_before":"high"},"analyst_status":"done","analyst_note":"Read the vendor advisory linked in the sources to confirm the fixed version and whether the endpoint is on by default.","search":"'-112186':14A,17A '-2026':13A,16A '5.4.0':78C '5.6.2':80C 'api':11A,35B,86C 'attack':52B,117C,150C 'authent':45B,114C 'bodi':39B,90C,106C 'caller':112C 'caus':69B,142C 'check':44B,109C 'crash':7A 'credenti':54B,120C 'cve':12A,15A 'deepli':66B,154C 'denial':71B,144C 'dozen':126C 'eclips':1A,21B,28B,75C 'eclipse':18A 'eclipse-kura':20B 'endpoint':103C 'everi':37B,92C 'exhaust':56B,134C 'fulli':40B 'gateway':25B 'heap':59B,137C 'iot':24B 'iot-gateway':23B 'java':26B,58B,136C 'json':4A,68B,89C,128C,156C 'kura':2A,19A,22B,29B,76C 'larg':127C 'likewis':147C 'limit':49B,98C 'list':10A,32B,83C,169C 'memori':42B,95C 'nest':67B,155C 'outofmemoryerror':140C 'overflow':64B 'packag':27B 'pars':104C 'read':36B,87C 'recurs':166C 'remot':51B,116C,149C 'request':5A,38B,93C,129C,157C 'rest':34B,85C 'send':123C,152C 'servic':9A,31B,73B,82C,146C,168C 'size':48B,101C 'stack':63B 'stackoverflowerror':161C 'therefor':122C 'time':133C 'trigger':61B,159C 'unauthent':3A 'unbound':165C 'v1':33B,84C,170C 'valid':119C 'version':77C 'whether':110C 'without':53B,118C","nicknames":[],"mitigations":[],"who_affected":"Systems running Eclipse Kura 5.4.0 through 5.6.2 with the Service Listing V1 REST API reachable over the network. The body is parsed before authentication, so the flaw is exposed to any remote caller who can reach the endpoint. Gateways where the API is blocked from untrusted networks are less exposed, but the sources do not say how to confirm that.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["eclipsekura","kura"],"ptokens":["eclipse","kura"],"labels":["eclipsekura","high","iotgateway","java","package","vendor"],"campaign_type":null,"search_a":"'-112186':14A,17A '-2026':13A,16A 'api':11A 'crash':7A 'cve':12A,15A 'eclips':1A 'eclipse':18A 'json':4A 'kura':2A,19A 'list':10A 'request':5A 'servic':9A 'unauthent':3A","search_b":"'api':35B 'attack':52B 'authent':45B 'bodi':39B 'caus':69B 'check':44B 'credenti':54B 'deepli':66B 'denial':71B 'eclips':21B,28B 'eclipse-kura':20B 'everi':37B 'exhaust':56B 'fulli':40B 'gateway':25B 'heap':59B 'iot':24B 'iot-gateway':23B 'java':26B,58B 'json':68B 'kura':22B,29B 'limit':49B 'list':32B 'memori':42B 'nest':67B 'overflow':64B 'packag':27B 'read':36B 'remot':51B 'request':38B 'rest':34B 'servic':31B,73B 'size':48B 'stack':63B 'trigger':61B 'v1':33B 'without':53B","search_c":"'5.4.0':78C '5.6.2':80C 'api':86C 'attack':117C,150C 'authent':114C 'bodi':90C,106C 'caller':112C 'caus':142C 'check':109C 'credenti':120C 'deepli':154C 'denial':144C 'dozen':126C 'eclips':75C 'endpoint':103C 'everi':92C 'exhaust':134C 'heap':137C 'java':136C 'json':89C,128C,156C 'kura':76C 'larg':127C 'likewis':147C 'limit':98C 'list':83C,169C 'memori':95C 'nest':155C 'outofmemoryerror':140C 'pars':104C 'read':87C 'recurs':166C 'remot':116C,149C 'request':93C,129C,157C 'rest':85C 'send':123C,152C 'servic':82C,146C,168C 'size':101C 'stackoverflowerror':161C 'therefor':122C 'time':133C 'trigger':159C 'unbound':165C 'v1':84C,170C 'valid':119C 'version':77C 'whether':110C 'without':118C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T17:17:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112186","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112186","severity":null,"published_at":"2026-11-10T17:17:20+00:00","modified_at":"2026-11-10T17:17:20+00:00","first_seen_at":"2026-11-10T17:22:40+00:00","fetched_at":"2026-11-10T17:22:40+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112186:2481","url":"https://github.com/eclipse-kura/kura/releases/tag/KURA_5.6.3_RELEASE","severity":null,"published_at":"2026-11-10T17:27:21+00:00","modified_at":"2026-11-10T17:27:21+00:00","first_seen_at":"2026-11-10T17:27:21+00:00","fetched_at":"2026-11-10T17:27:21+00:00","note":"GHSA page was unreadable (empty fetch); NVD text gives affected 5.4.0-5.6.2. Fix 5.6.3 taken from vendor release notes, whose commits (permission check before body read, 64 KiB cap, filter nesting limit in rest.service.listing.provider) match the flaw, but the notes do not name this CVE, so nothing marked verified. Whether the REST API is on by default not confirmed; 'default-config' not-affected tag is unsupported by sources. No exploitation or PoC found.","cites":["https://github.com/eclipse-kura/kura/releases/tag/KURA_5.6.3_RELEASE"]}],"documents":[{"id":116492,"url":"https://github.com/eclipse-kura/kura/security/advisories/GHSA-pwq4-h95h-5634","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":116653,"url":"https://github.com/eclipse-kura/kura/releases/tag/KURA_5.6.3_RELEASE","title":"Eclipse Kura 5.6.3 release notes","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}