CVE-2026-97891 · Infrastructure
NO FIX YET · SEE WHAT TO DO
In Eclipse Kura 5.0.0 through 5.6.2, the Web Console creates a new HTTP session for every request to its login endpoints before checking credentials, with no limit. An unauthenticated attacker can flood those endpoints, exhaust the Java heap, and crash the Kura process.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Gateways and edge devices running Eclipse Kura 5.0.0 through 5.6.2 with the Web Console enabled. An attacker needs network access to the Web Console login endpoints; devices where the console is restricted to a trusted network are less exposed. The sources do not say whether any default configuration exposes it.
Not affected if console-not-network-reachable, kura-outside-range
Who cares eclipse-kura, iot-gateway, java, web-console
5.0.0 to 5.6.2 are in range./admin/auth, /admin/login/password and /admin/login/cert paths.5.6.2; the sources do not name the exact fixed release.In Eclipse Kura version 5.0.0 to 5.6.2, the Web Console allocates a new HTTP session for every request to its built-in authentication endpoints (/admin/auth, /admin/login/password, /admin/login/cert) before checking the HTTP method, parsing the request, or validating any submitted credentials, and does not limit how many such sessions can be allocated. An unauthenticated client that sends requests to these endpoints without honoring the returned session cookie can cause the server to allocate an unbounded number of sessions, exhausting the JVM heap and crashing the Kura process.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.