---
id: "CVE-2026-114359"
page: "https://infrastack.ai/live/CVE-2026-114359"
kind: "vulnerability"
aliases: ["CVE-2026-114359"]
title: "Eclipse Kura: deployment package download has no size limit, fills disk"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["eclipse-kura", "edge-devices", "embedded-linux", "iot-gateway", "runtime"]
not_affected_if: ["restricted-deploy-permissions", "trusted-https-sources-only"]
published_at: "2026-11-10T15:17:12+00:00"
first_seen_at: "2026-11-10T15:22:22+00:00"
updated_at: "2026-11-10T15:23:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114359", "first_seen_at": "2026-11-10T15:22:22+00:00"}, {"source": "analyst", "url": "https://github.com/eclipse-kura/kura/releases", "first_seen_at": "2026-11-10T15:23:20+00:00", "cites": ["https://github.com/eclipse-kura/kura/releases"]}]
exploit_sources: []
---

# Eclipse Kura: deployment package download has no size limit, fills disk

Link for people: https://infrastack.ai/live/CVE-2026-114359 (this .md is for agents)

Eclipse Kura, the gateway framework for industrial IoT devices, downloads deployment packages from a remote URL and writes them to local storage without any size limit. A malicious or compromised server, or an attacker who can tamper with a plain-HTTP download, can exhaust disk or memory and take the device down.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Kura version: versions before 5.6.3 are probably affected, but the advisory's affected range could not be read, so treat that as unconfirmed.
- Check whether POST /deploy/v2/_upload is reachable from untrusted networks.
- Check whether deployment packages are installed from plain-HTTP URLs.
- Check who holds kura.packages.admin, kura.permission.rest.deploy and cloud DEPLOY-V2 access.

## Fix

Upgrade to Eclipse Kura 5.6.3, whose release notes add file transfer size limits for DeploymentAgent, DEPLOY-V2 and the Web UI. The release notes do not cite this CVE, so confirm against the GHSA.

## Timeline

- 2026-11-10T15:22:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114359
- 2026-11-10T15:23:20+00:00 analyst https://github.com/eclipse-kura/kura/releases — GHSA page not readable (404 to fetch; empty via web-cli). Kura 5.6.3 release notes (9 Nov 2026) list 'limit file transfer size on DeploymentAgent, DEPLOY-V2, and web UI' (93c1233), which matches this issue but does not cite the CVE. Affected range unknown; fix version is inferred, not verified. Nothing marked verified.

## Documents

- [advisory] Vendor advisory: github.com https://github.com/eclipse-kura/kura/security/advisories/GHSA-r8mm-3wcm-qmx4
- [fix] Eclipse Kura 5.6.3 release notes https://github.com/eclipse-kura/kura/releases

## From the sources

Eclipse Kura downloads deployment packages (DPs) from a remote URL without any limit on the size of the data it receives. A malicious or compromised HTTP(S) server, or an attacker able to tamper with a plain-HTTP download, can stream an arbitrarily large (or endless) response. Kura writes the response to local storage until the filesystem is full. On gateways the temporary directory is often a RAM-backed tmpfs, so this can also exhaust memory. The result is denial of service of the device: failed configuration persistence, failed logging and possible crashes of the framework or other services.



The same missing size limit is present in the REST upload endpoint `POST /deploy/v2/_upload`, which copies the request body to the temporary directory with no limit.



Workarounds: only install DPs from trusted HTTPS sources, restrict who can install packages (Web UI `kura.packages.admin` permission, REST `kura.permission.rest.deploy`, cloud DEPLOY-V2 access).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_