CVE-2026-114359

Eclipse Kura downloads deployment packages (DPs) from a remote URL without any limit on the size of the data it receives.

Eclipse Kura downloads deployment packages (DPs) from a remote URL without any limit on the size of the data it receives. A malicious or compromised HTTP(S) server, or an attacker able to tamper with a plain-HTTP download, can stream an arbitrarily large (or endless) response. Kura writes the response to local storage until the filesystem is full. On gateways the temporary directory is often a RAM-backed tmpfs, so this can also exhaust memory. The result is denial of service…

10. Nov 2026

Ausgewertete Quellen

• NVD
  CVE-2026-114359