CVE-2026-112186

Name of the Vulnerable Software and Affected Versions Eclipse Kura versions 5.4.0 through 5.6.2

Description The Service Listing V1 REST API reads the JSON body of every request into memory without size limits. Because the endpoints parse the body before verifying authentication, an unauthenticated remote attacker can cause a denial of service by sending multiple large JSON requests to exhaust the Java heap, resulting in an OutOfMemoryError. Additionally, sending a deeply nested JSON request can trigger a StackOverflowError due to unbound recursion in the Service Listing V1.

Recommendations Update Eclipse Kura to a version later than 5.6.2.