{"id":"CVE-2026-97891","kind":"vulnerability","aliases":["CVE-2026-97891"],"related":[],"title":"Eclipse Kura: unauthenticated requests exhaust server memory and crash the gateway","description":"In Eclipse Kura version 5.0.0 to 5.6.2, the Web Console allocates a new HTTP session for every request to its built-in authentication endpoints (/admin/auth, /admin/login/password, /admin/login/cert) before checking the HTTP method, parsing the request, or validating any submitted credentials, and does not limit how many such sessions can be allocated. An unauthenticated client that sends requests to these endpoints without honoring the returned session cookie can cause the server to allocate an unbounded number of sessions, exhausting the JVM heap and crashing the Kura process.","summary":"In Eclipse Kura 5.0.0 through 5.6.2, the Web Console creates a new HTTP session for every request to its login endpoints before checking credentials, with no limit. An unauthenticated attacker can flood those endpoints, exhaust the Java heap, and crash the Kura process.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["eclipse-kura","infrastructure","iot-gateway","java","web-console"],"not_affected_if":["console-not-network-reachable","kura-outside-range"],"how_to_check":"- Check the installed Kura version in the gateway's package or the Kura Web Console about page; versions `5.0.0` to `5.6.2` are in range.\n- Confirm the Web Console is reachable from networks that should not reach it, on the `/admin/auth`, `/admin/login/password` and `/admin/login/cert` paths.","fix":"- Eclipse Kura: move to a version newer than `5.6.2`; the sources do not name the exact fixed release.","status":"open","published_at":"2026-11-10T17:17:57+00:00","first_seen_at":"2026-11-10T17:22:45+00:00","triaged_at":"2026-11-10T17:23:42+00:00","updated_at":"2026-11-10T17:23:42+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T17:23:42Z","model":"claude-haiku-5-5","output":{"fix":"- Eclipse Kura: move to a version newer than `5.6.2`; the sources do not name the exact fixed release.","reach":"network","title":"Eclipse Kura: unauthenticated requests exhaust server memory and crash the gateway","impact":"medium","summary":"In Eclipse Kura 5.0.0 through 5.6.2, the Web Console creates a new HTTP session for every request to its login endpoints before checking credentials, with no limit. An unauthenticated attacker can flood those endpoints, exhaust the Java heap, and crash the Kura process.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["eclipse-kura","iot-gateway","java","web-console"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Unauthenticated requests crash the Kura process by exhausting heap memory","analyst_note":"Confirm the fixed Kura version and whether the Web Console is enabled by default, via the vendor advisory linked in the sources.","how_to_check":"- Check the installed Kura version in the gateway's package or the Kura Web Console about page; versions `5.0.0` to `5.6.2` are in range.\n- Confirm the Web Console is reachable from networks that should not reach it, on the `/admin/auth`, `/admin/login/password` and `/admin/login/cert` paths.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["kura-outside-range","console-not-network-reachable"],"who_is_affected":"Gateways and edge devices running Eclipse Kura 5.0.0 through 5.6.2 with the Web Console enabled. An attacker needs network access to the Web Console login endpoints; devices where the console is restricted to a trusted network are less exposed. The sources do not say whether any default configuration exposes it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000803,"input_tokens":4670,"output_tokens":671,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-97891':14A,17A '/admin/auth':97C '/admin/login/cert':99C '/admin/login/password':98C '5.0.0':32B,76C '5.6.2':34B,78C 'alloc':82C,123C,144C 'attack':58B 'authent':95C 'built':93C 'built-in':92C 'caus':140C 'check':51B,101C 'client':126C 'consol':28B,37B,81C 'cooki':138C 'crash':9A,68B,155C 'creat':38B 'credenti':52B,112C 'cve':12A,15A 'eclips':1A,19B,30B,73C 'eclipse-kura':18B 'endpoint':49B,62B,96C,132C 'everi':44B,88C 'exhaust':5A,63B,150C 'flood':60B 'gateway':11A,24B 'heap':66B,153C 'honor':134C 'http':41B,85C,103C 'infrastructur':21B 'iot':23B 'iot-gateway':22B 'java':25B,65B 'jvm':152C 'kura':2A,20B,31B,70B,74C,157C 'limit':55B,116C 'login':48B 'mani':118C 'memori':7A 'method':104C 'new':40B,84C 'number':147C 'pars':105C 'process':71B,158C 'request':4A,45B,89C,107C,129C 'return':136C 'send':128C 'server':6A,142C 'session':42B,86C,120C,137C,149C 'submit':111C 'unauthent':3A,57B,125C 'unbound':146C 'valid':109C 'version':75C 'web':27B,36B,80C 'web-consol':26B 'without':133C","nicknames":[],"mitigations":[],"who_affected":"Gateways and edge devices running Eclipse Kura 5.0.0 through 5.6.2 with the Web Console enabled. An attacker needs network access to the Web Console login endpoints; devices where the console is restricted to a trusted network are less exposed. The sources do not say whether any default configuration exposes it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["eclipsekura","high","infrastructure","iotgateway","java","webconsole"],"campaign_type":null,"search_a":"'-2026':13A,16A '-97891':14A,17A 'crash':9A 'cve':12A,15A 'eclips':1A 'exhaust':5A 'gateway':11A 'kura':2A 'memori':7A 'request':4A 'server':6A 'unauthent':3A","search_b":"'5.0.0':32B '5.6.2':34B 'attack':58B 'check':51B 'consol':28B,37B 'crash':68B 'creat':38B 'credenti':52B 'eclips':19B,30B 'eclipse-kura':18B 'endpoint':49B,62B 'everi':44B 'exhaust':63B 'flood':60B 'gateway':24B 'heap':66B 'http':41B 'infrastructur':21B 'iot':23B 'iot-gateway':22B 'java':25B,65B 'kura':20B,31B,70B 'limit':55B 'login':48B 'new':40B 'process':71B 'request':45B 'session':42B 'unauthent':57B 'web':27B,36B 'web-consol':26B","search_c":"'/admin/auth':97C '/admin/login/cert':99C '/admin/login/password':98C '5.0.0':76C '5.6.2':78C 'alloc':82C,123C,144C 'authent':95C 'built':93C 'built-in':92C 'caus':140C 'check':101C 'client':126C 'consol':81C 'cooki':138C 'crash':155C 'credenti':112C 'eclips':73C 'endpoint':96C,132C 'everi':88C 'exhaust':150C 'heap':153C 'honor':134C 'http':85C,103C 'jvm':152C 'kura':74C,157C 'limit':116C 'mani':118C 'method':104C 'new':84C 'number':147C 'pars':105C 'process':158C 'request':89C,107C,129C 'return':136C 'send':128C 'server':142C 'session':86C,120C,137C,149C 'submit':111C 'unauthent':125C 'unbound':146C 'valid':109C 'version':75C 'web':80C 'without':133C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T17:17:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97891","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97891","severity":null,"published_at":"2026-11-10T17:17:57+00:00","modified_at":"2026-11-10T17:17:57+00:00","first_seen_at":"2026-11-10T17:22:45+00:00","fetched_at":"2026-11-10T17:22:45+00:00","note":null}],"documents":[{"id":116540,"url":"https://github.com/eclipse-kura/kura/security/advisories/GHSA-4pwp-99h8-c44j","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}