CVE-2026-114359 · Runtime
NO FIX YET · SEE WHAT TO DO
Eclipse Kura, the gateway framework for industrial IoT devices, downloads deployment packages from a remote URL and writes them to local storage without any size limit. A malicious or compromised server, or an attacker who can tamper with a plain-HTTP download, can exhaust disk or memory and take the device down.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running Eclipse Kura on gateways or edge devices that install deployment packages, especially where the device can be reached from untrusted networks or packages are fetched over plain HTTP. Devices that only install packages from trusted HTTPS sources, with package-install permissions restricted to trusted users, are less exposed. The sources do not list affected versions.
Not affected if restricted-deploy-permissions, trusted-https-sources-only
Who cares eclipse-kura, edge-devices, embedded-linux, iot-gateway
5.6.3, whose release notes add file transfer size limits for DeploymentAgent, DEPLOY-V2 and the Web UIEclipse Kura downloads deployment packages (DPs) from a remote URL without any limit on the size of the data it receives. A malicious or compromised HTTP(S) server, or an attacker able to tamper with a plain-HTTP download, can stream an arbitrarily large (or endless) response. Kura writes the response to local storage until the filesystem is full. On gateways the temporary directory is often a RAM-backed tmpfs, so this can also exhaust memory. The result is denial of service of the device: failed configuration persistence, failed logging and possible crashes of the framework or other services.
The same missing size limit is present in the REST upload endpoint POST /deploy/v2/_upload, which copies the request body to the temporary directory with no limit.
Workarounds: only install DPs from trusted HTTPS sources, restrict who can install packages (Web UI kura.packages.admin permission, REST kura.permission.rest.deploy, cloud DEPLOY-V2 access).
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.