CVE-2026-112186

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-112186

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112186.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-112186

Aliases

GHSA-pwq4-h95h-5634

Published

2026-11-10T17:02:46Z

Modified

2026-11-11T02:48:50Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L CVSS Calculator

Summary

[none]

Details

In Eclipse Kura versions 5.4.0 through 5.6.2, the Service Listing V1 REST API read the JSON body of every request into memory, with no limit on its size. The endpoints parse the body before they check whether the caller is authenticated. A remote attacker without valid credentials can therefore send a few dozen large JSON requests at the same time, exhaust the Java heap with an OutOfMemoryError, and cause a denial of service. Likewise, a remote attacker, can send a deeply nested JSON request and trigger a StackOverflowError because of an unbound recursion in Service Listing V1.

Database specific

{
    "cna_assigner": "eclipse",
    "cwe_ids": [
        "CWE-674",
        "CWE-696",
        "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112186.json"
}

References

Affected packages

Git / github.com/eclipse-kura/kura

Affected ranges

Type

GIT

Repo

https://github.com/eclipse-kura/kura

Events

Introduced

d26bca6c654a3285447b21eb979f26e28584244b

Last Affected

42ecc87c4dca3e4e11d4181493506d822f92aa6f

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "5.4.0"
                },
                {
                    "last_affected": "5.6.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112186.json"