CVE-2026-97891

Name of the Vulnerable Software and Affected Versions Eclipse Kura versions 5.0.0 through 5.6.2

Description The Web Console allocates a new HTTP session for every request to its built-in authentication endpoints before validating credentials or checking the HTTP method. Because there is no limit on the number of sessions that can be allocated, an unauthenticated client can trigger the allocation of an unbounded number of sessions by ignoring returned session cookies. This leads to the exhaustion of the JVM heap (the memory area where the Java Virtual Machine stores objects), resulting in a crash of the Kura process. The affected API endpoints are "/admin/auth", "/admin/login/password", and "/admin/login/cert".

Recommendations Update Eclipse Kura to a version later than 5.6.2.