{"id":"CVE-2026-114359","kind":"vulnerability","aliases":["CVE-2026-114359"],"related":[],"title":"Eclipse Kura: deployment package download has no size limit, fills disk","description":"Eclipse Kura downloads deployment packages (DPs) from a remote URL without any limit on the size of the data it receives. A malicious or compromised HTTP(S) server, or an attacker able to tamper with a plain-HTTP download, can stream an arbitrarily large (or endless) response. Kura writes the response to local storage until the filesystem is full. On gateways the temporary directory is often a RAM-backed tmpfs, so this can also exhaust memory. The result is denial of service of the device: failed configuration persistence, failed logging and possible crashes of the framework or other services.\n\n\n\nThe same missing size limit is present in the REST upload endpoint `POST /deploy/v2/_upload`, which copies the request body to the temporary directory with no limit.\n\n\n\nWorkarounds: only install DPs from trusted HTTPS sources, restrict who can install packages (Web UI `kura.packages.admin` permission, REST `kura.permission.rest.deploy`, cloud DEPLOY-V2 access).","summary":"Eclipse Kura, the gateway framework for industrial IoT devices, downloads deployment packages from a remote URL and writes them to local storage without any size limit. A malicious or compromised server, or an attacker who can tamper with a plain-HTTP download, can exhaust disk or memory and take the device down.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["eclipse-kura","edge-devices","embedded-linux","iot-gateway","runtime"],"not_affected_if":["restricted-deploy-permissions","trusted-https-sources-only"],"how_to_check":"- Check the installed Kura version: versions before 5.6.3 are probably affected, but the advisory's affected range could not be read, so treat that as unconfirmed.\n- Check whether POST /deploy/v2/_upload is reachable from untrusted networks.\n- Check whether deployment packages are installed from plain-HTTP URLs.\n- Check who holds kura.packages.admin, kura.permission.rest.deploy and cloud DEPLOY-V2 access.","fix":"Upgrade to Eclipse Kura 5.6.3, whose release notes add file transfer size limits for DeploymentAgent, DEPLOY-V2 and the Web UI. The release notes do not cite this CVE, so confirm against the GHSA.","status":"open","published_at":"2026-11-10T15:17:12+00:00","first_seen_at":"2026-11-10T15:22:22+00:00","triaged_at":"2026-11-10T15:22:46+00:00","updated_at":"2026-11-10T15:23:20+00:00","category":"runtime","confidence":0.55,"triage":{"at":"2026-11-10T15:22:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Eclipse Kura: deployment package download has no size limit, fills disk","impact":"medium","summary":"Eclipse Kura, the gateway framework for industrial IoT devices, downloads deployment packages from a remote URL and writes them to local storage without any size limit. A malicious or compromised server, or an attacker who can tamper with a plain-HTTP download, can exhaust disk or memory and take the device down.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["eclipse-kura","iot-gateway","edge-devices","embedded-linux"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Device storage or memory exhausted, services and configuration persistence fail","analyst_note":"Find affected and fixed Kura versions and the vendor advisory on github.com, which the sources list but do not quote.","how_to_check":"- Check whether the Kura version in use is in the affected range listed in the advisory: unknown\n- Check whether the REST endpoint `POST /deploy/v2/_upload` is reachable from untrusted networks\n- Check whether deployment packages are installed from plain-HTTP URLs","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["trusted-https-sources-only","restricted-deploy-permissions"],"who_is_affected":"Teams running Eclipse Kura on gateways or edge devices that install deployment packages, especially where the device can be reached from untrusted networks or packages are fetched over plain HTTP. Devices that only install packages from trusted HTTPS sources, with package-install permissions restricted to trusted users, are less exposed. The sources do not list affected versions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000803,"input_tokens":4797,"output_tokens":646,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected and fixed Kura versions and the vendor advisory on github.com, which the sources list but do not quote.","search":"'-114359':14A,17A '-2026':13A,16A '/deploy/v2/_upload':197C 'abl':114C 'access':233C 'also':158C 'arbitrarili':126C 'attack':64B,113C 'back':153C 'bodi':202C 'cloud':229C 'compromis':60B,107C 'configur':171C 'copi':199C 'crash':177C 'cve':12A,15A 'data':101C 'denial':164C 'deploy':3A,41B,86C,231C 'deploy-v2':230C 'devic':23B,39B,82B,169C 'directori':147C,206C 'disk':11A,76B 'download':5A,40B,73B,85C,122C 'dps':88C,213C 'eclips':1A,19B,31B,83C 'eclipse-kura':18B 'edg':22B 'edge-devic':21B 'embed':25B 'embedded-linux':24B 'endless':129C 'endpoint':195C 'exhaust':75B,159C 'fail':170C,173C 'filesystem':140C 'fill':10A 'framework':35B,180C 'full':142C 'gateway':29B,34B,144C 'http':72B,108C,121C 'https':216C 'industri':37B 'instal':212C,221C 'iot':28B,38B 'iot-gateway':27B 'kura':2A,20B,32B,84C,131C 'kura.packages.admin':225C 'kura.permission.rest.deploy':228C 'larg':127C 'limit':9A,56B,95C,188C,209C 'linux':26B 'local':51B,136C 'log':174C 'malici':58B,105C 'memori':78B,160C 'miss':186C 'often':149C 'packag':4A,42B,87C,222C 'permiss':226C 'persist':172C 'plain':71B,120C 'plain-http':70B,119C 'possibl':176C 'post':196C 'present':190C 'ram':152C 'ram-back':151C 'receiv':103C 'remot':45B,91C 'request':201C 'respons':130C,134C 'rest':193C,227C 'restrict':218C 'result':162C 'runtim':30B 'server':61B,110C 'servic':166C,183C 'size':8A,55B,98C,187C 'sourc':217C 'storag':52B,137C 'stream':124C 'take':80B 'tamper':67B,116C 'temporari':146C,205C 'tmpfs':154C 'trust':215C 'ui':224C 'upload':194C 'url':46B,92C 'v2':232C 'web':223C 'without':53B,93C 'workaround':210C 'write':48B,132C","nicknames":[],"mitigations":[],"who_affected":"Teams running Eclipse Kura on gateways or edge devices that install deployment packages, especially where the device can be reached from untrusted networks or packages are fetched over plain HTTP. Devices that only install packages from trusted HTTPS sources, with package-install permissions restricted to trusted users, are less exposed. The sources do not list affected versions.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["eclipsekura","edgedevices","embeddedlinux","high","iotgateway","runtime"],"campaign_type":null,"search_a":"'-114359':14A,17A '-2026':13A,16A 'cve':12A,15A 'deploy':3A 'disk':11A 'download':5A 'eclips':1A 'fill':10A 'kura':2A 'limit':9A 'packag':4A 'size':8A","search_b":"'attack':64B 'compromis':60B 'deploy':41B 'devic':23B,39B,82B 'disk':76B 'download':40B,73B 'eclips':19B,31B 'eclipse-kura':18B 'edg':22B 'edge-devic':21B 'embed':25B 'embedded-linux':24B 'exhaust':75B 'framework':35B 'gateway':29B,34B 'http':72B 'industri':37B 'iot':28B,38B 'iot-gateway':27B 'kura':20B,32B 'limit':56B 'linux':26B 'local':51B 'malici':58B 'memori':78B 'packag':42B 'plain':71B 'plain-http':70B 'remot':45B 'runtim':30B 'server':61B 'size':55B 'storag':52B 'take':80B 'tamper':67B 'url':46B 'without':53B 'write':48B","search_c":"'/deploy/v2/_upload':197C 'abl':114C 'access':233C 'also':158C 'arbitrarili':126C 'attack':113C 'back':153C 'bodi':202C 'cloud':229C 'compromis':107C 'configur':171C 'copi':199C 'crash':177C 'data':101C 'denial':164C 'deploy':86C,231C 'deploy-v2':230C 'devic':169C 'directori':147C,206C 'download':85C,122C 'dps':88C,213C 'eclips':83C 'endless':129C 'endpoint':195C 'exhaust':159C 'fail':170C,173C 'filesystem':140C 'framework':180C 'full':142C 'gateway':144C 'http':108C,121C 'https':216C 'instal':212C,221C 'kura':84C,131C 'kura.packages.admin':225C 'kura.permission.rest.deploy':228C 'larg':127C 'limit':95C,188C,209C 'local':136C 'log':174C 'malici':105C 'memori':160C 'miss':186C 'often':149C 'packag':87C,222C 'permiss':226C 'persist':172C 'plain':120C 'plain-http':119C 'possibl':176C 'post':196C 'present':190C 'ram':152C 'ram-back':151C 'receiv':103C 'remot':91C 'request':201C 'respons':130C,134C 'rest':193C,227C 'restrict':218C 'result':162C 'server':110C 'servic':166C,183C 'size':98C,187C 'sourc':217C 'storag':137C 'stream':124C 'tamper':116C 'temporari':146C,205C 'tmpfs':154C 'trust':215C 'ui':224C 'upload':194C 'url':92C 'v2':232C 'web':223C 'without':93C 'workaround':210C 'write':132C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T15:17:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114359","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114359","severity":null,"published_at":"2026-11-10T15:17:12+00:00","modified_at":"2026-11-10T15:17:12+00:00","first_seen_at":"2026-11-10T15:22:22+00:00","fetched_at":"2026-11-10T15:22:22+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114359:2461","url":"https://github.com/eclipse-kura/kura/releases","severity":null,"published_at":"2026-11-10T15:23:20+00:00","modified_at":"2026-11-10T15:23:20+00:00","first_seen_at":"2026-11-10T15:23:20+00:00","fetched_at":"2026-11-10T15:23:20+00:00","note":"GHSA page not readable (404 to fetch; empty via web-cli). Kura 5.6.3 release notes (9 Nov 2026) list 'limit file transfer size on DeploymentAgent, DEPLOY-V2, and web UI' (93c1233), which matches this issue but does not cite the CVE. Affected range unknown; fix version is inferred, not verified. Nothing marked verified.","cites":["https://github.com/eclipse-kura/kura/releases"]}],"documents":[{"id":115689,"url":"https://github.com/eclipse-kura/kura/security/advisories/GHSA-r8mm-3wcm-qmx4","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":115752,"url":"https://github.com/eclipse-kura/kura/releases","title":"Eclipse Kura 5.6.3 release notes","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}