---
id: "CVE-2026-112186"
page: "https://infrastack.ai/live/CVE-2026-112186"
kind: "vulnerability"
aliases: ["CVE-2026-112186"]
title: "Eclipse Kura: unauthenticated JSON requests can crash the Service Listing API"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Eclipse Kura", "fixed": ["5.6.3"], "affected": ">= 5.4.0, <= 5.6.2", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["eclipse-kura", "iot-gateway", "java", "package"]
not_affected_if: ["default-config"]
published_at: "2026-11-10T17:17:20+00:00"
first_seen_at: "2026-11-10T17:22:40+00:00"
updated_at: "2026-11-10T17:27:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112186", "first_seen_at": "2026-11-10T17:22:40+00:00"}, {"source": "analyst", "url": "https://github.com/eclipse-kura/kura/releases/tag/KURA_5.6.3_RELEASE", "first_seen_at": "2026-11-10T17:27:21+00:00", "cites": ["https://github.com/eclipse-kura/kura/releases/tag/KURA_5.6.3_RELEASE"]}]
exploit_sources: []
---

# Eclipse Kura: unauthenticated JSON requests can crash the Service Listing API

Link for people: https://infrastack.ai/live/CVE-2026-112186 (this .md is for agents)

Eclipse Kura's Service Listing V1 REST API reads every request body fully into memory before checking authentication, with no size limit. A remote attacker without credentials can exhaust the Java heap or trigger a stack overflow with deeply nested JSON, causing a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Eclipse Kura affected >= 5.4.0, <= 5.6.2 fixed 5.6.3

## How to check

- Check the installed Kura version; 5.4.0 through 5.6.2 is affected, 5.6.3 contains the fix.
- Check whether the Kura REST service (Service Listing V1, org.eclipse.kura.rest.service.listing.provider) is installed and its HTTP/HTTPS port is reachable from untrusted networks.
- Until upgraded, block or firewall the Kura REST port from untrusted networks.

## Fix

Upgrade Eclipse Kura to 5.6.3 (released 2026-11-09). Release notes: permission checks now run before the request body is read, request body capped to 64 KiB on the relevant REST APIs, and property filter nesting depth limited in rest.service.listing.provider.

## Timeline

- 2026-11-10T17:22:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112186
- 2026-11-10T17:27:21+00:00 analyst https://github.com/eclipse-kura/kura/releases/tag/KURA_5.6.3_RELEASE — GHSA page was unreadable (empty fetch); NVD text gives affected 5.4.0-5.6.2. Fix 5.6.3 taken from vendor release notes, whose commits (permission check before body read, 64 KiB cap, filter nesting limit in rest.service.listing.provider) match the flaw, but the notes do not name this CVE, so nothing marked verified. Whether the REST API is on by default not confirmed; 'default-config' not-affected tag is unsupported by sources. No exploitation or PoC found.

## Documents

- [advisory] Vendor advisory: github.com https://github.com/eclipse-kura/kura/security/advisories/GHSA-pwq4-h95h-5634
- [fix] Eclipse Kura 5.6.3 release notes https://github.com/eclipse-kura/kura/releases/tag/KURA_5.6.3_RELEASE

## From the sources

In Eclipse Kura versions 5.4.0 through 5.6.2, the Service Listing V1 REST API read the JSON body of every request into memory, with no limit on its size. The endpoints parse the body before they check whether the caller is authenticated. A remote attacker without valid credentials can therefore send a few dozen large JSON requests at the same time, exhaust the Java heap with an `OutOfMemoryError`, and cause a denial of service. Likewise, a remote attacker, can send a deeply nested JSON request and trigger a `StackOverflowError` because of an unbound recursion in Service Listing V1.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_