Eclipse Kura 5.6.2 iBeacon/Eddystone Scanner DoS via BLE AD length
CVE-2026-97402 Published on November 10, 2026
In Eclipse Kura versions 3.1.0 to 5.6.2, the iBeacon and Eddystone advertisement decoders wrongly parse the AD-structure length field of an over-the-air BLE advertising payload. Any unauthenticated attacker within BLE radio range can broadcast a two-byte advertising payload that drives the Kura beacon-scanner thread into a tight infinite loop, pinning a CPU core and permanently halting beacon ingestion until the gateway is restarted. To trigger the attack, the iBeacon/Eddystone scanner component should be installed and active. By default the components are not installed or enabled.
Vulnerability Analysis
Weakness Types
What is an Infinite Loop Vulnerability?
The program contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. If the loop can be influenced by an attacker, this weakness could allow attackers to consume excessive resources such as CPU or memory.
CVE-2026-97402 has been classified to as an Infinite Loop vulnerability or weakness.
Unexpected Sign Extension
The software performs an operation on a number that causes it to be sign extended when it is transformed into a larger data type. When the original number is negative, this can produce unexpected values that lead to resultant weaknesses.
Products Associated with CVE-2026-97402
Want to know whenever a new CVE is published for Eclipse Kura? stack.watch will email you.
Affected Versions
Eclipse Foundation Eclipse Kura:- Version 3.1.0, <= 5.6.2 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.