---
id: "CVE-2026-97891"
page: "https://infrastack.ai/live/CVE-2026-97891"
kind: "vulnerability"
aliases: ["CVE-2026-97891"]
title: "Eclipse Kura: unauthenticated requests exhaust server memory and crash the gateway"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["eclipse-kura", "infrastructure", "iot-gateway", "java", "web-console"]
not_affected_if: ["console-not-network-reachable", "kura-outside-range"]
published_at: "2026-11-10T17:17:57+00:00"
first_seen_at: "2026-11-10T17:22:45+00:00"
updated_at: "2026-11-10T17:23:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97891", "first_seen_at": "2026-11-10T17:22:45+00:00"}]
exploit_sources: []
---

# Eclipse Kura: unauthenticated requests exhaust server memory and crash the gateway

Link for people: https://infrastack.ai/live/CVE-2026-97891 (this .md is for agents)

In Eclipse Kura 5.0.0 through 5.6.2, the Web Console creates a new HTTP session for every request to its login endpoints before checking credentials, with no limit. An unauthenticated attacker can flood those endpoints, exhaust the Java heap, and crash the Kura process.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Kura version in the gateway's package or the Kura Web Console about page; versions `5.0.0` to `5.6.2` are in range.
- Confirm the Web Console is reachable from networks that should not reach it, on the `/admin/auth`, `/admin/login/password` and `/admin/login/cert` paths.

## Fix

- Eclipse Kura: move to a version newer than `5.6.2`; the sources do not name the exact fixed release.

## Timeline

- 2026-11-10T17:22:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-97891

## Documents

- [advisory] Vendor advisory: github.com https://github.com/eclipse-kura/kura/security/advisories/GHSA-4pwp-99h8-c44j

## From the sources

In Eclipse Kura version 5.0.0 to 5.6.2, the Web Console allocates a new HTTP session for every request to its built-in authentication endpoints (/admin/auth, /admin/login/password, /admin/login/cert) before checking the HTTP method, parsing the request, or validating any submitted credentials, and does not limit how many such sessions can be allocated. An unauthenticated client that sends requests to these endpoints without honoring the returned session cookie can cause the server to allocate an unbounded number of sessions, exhausting the JVM heap and crashing the Kura process.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_