Eclipse Kura 5.6.2 Service Listing V1 REST API Unlimited JSON DoS
CVE-2026-112186 Published on November 10, 2026
In Eclipse Kura versions 5.4.0 through 5.6.2, the Service Listing V1 REST API read the JSON body of every request into memory, with no limit on its size. The endpoints parse the body before they check whether the caller is authenticated. A remote attacker without valid credentials can therefore send a few dozen large JSON requests at the same time, exhaust the Java heap with an `OutOfMemoryError`, and cause a denial of service. Likewise, a remote attacker, can send a deeply nested JSON request and trigger a `StackOverflowError` because of an unbound recursion in Service Listing V1.
Vulnerability Analysis
CVE-2026-112186 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Types
Incorrect Behavior Order
The product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways which may produce resultant weaknesses.
What is a Stack Exhaustion Vulnerability?
The product does not properly control the amount of recursion which takes place, consuming excessive resources, such as allocated memory or the program stack.
CVE-2026-112186 has been classified to as a Stack Exhaustion vulnerability or weakness.
Allocation of Resources Without Limits or Throttling
The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Products Associated with CVE-2026-112186
Want to know whenever a new CVE is published for Eclipse Kura? stack.watch will email you.
Affected Versions
Eclipse Foundation Eclipse Kura:- Version 5.4.0, <= 5.6.2 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.