CVE-2026-112186
2026-11-10
17h17 +00:00
17h17 +00:00
指定 CVE 通知
掌握特定 CVE 的任何變更。
CVE 描述
In Eclipse Kura versions 5.4.0 through 5.6.2, the Service Listing V1 REST API read the JSON body of every request into memory, with no limit on its size. The endpoints parse the body before they check whether the caller is authenticated. A remote attacker without valid credentials can therefore send a few dozen large JSON requests at the same time, exhaust the Java heap with an `OutOfMemoryError`, and cause a denial of service. Likewise, a remote attacker, can send a deeply nested JSON request and trigger a `StackOverflowError` because of an unbound recursion in Service Listing V1.
CVE 資訊
相關弱點
| 弱點名稱 | 來源 | |
|---|---|---|
| Uncontrolled Recursion The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack. |
||
| Incorrect Behavior Order The product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways that may produce resultant weaknesses. |
||
| Allocation of Resources Without Limits or Throttling The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
