Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-114359

Quick assessment

Affected
Eclipse Foundation Eclipse Kura
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Eclipse Kura 会从远程 URL 下载部署包（DP），且对接收数据的体积没有限制。恶意或已被攻陷的 HTTP(S) 服务器，或能够篡改明文 HTTP 下载的攻击者，可以流式传输任意大（甚至无限长）的响应。Kura 会将响应内容持续写入本地存储，直到文件系统被填满。在网关设备上，临时目录通常基于内存的 tmpfs 实现，因此该行为同样可能导致内存耗尽。最终后果是设备拒绝服务：配置无法持久化、日志记录失败，以及框架或其他服务可能崩溃。 REST 上传端点 也存在相同的大小限制缺失问题：该端点会将请求体无限制地

CVSS 7.0 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-114359

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Eclipse Kura downloads deployment packages (DPs) from a remote URL without any limit on the size of the data it receives. A malicious or compromised HTTP(S) server, or an attacker able to tamper with a plain-HTTP download, can stream an arbitrarily large (or endless) response. Kura writes the response to local storage until the filesystem is full. On gateways the temporary directory is often a RAM-backed tmpfs, so this can also exhaust memory. The result is denial of service of the device: failed configuration persistence, failed logging and possible crashes of the framework or other services. The same missing size limit is present in the REST upload endpoint `POST /deploy/v2/_upload`, which copies the request body to the temporary directory with no limit. Workarounds: only install DPs from trusted HTTPS sources, restrict who can install packages (Web UI `kura.packages.admin` permission, REST `kura.permission.rest.deploy`, cloud DEPLOY-V2 access).
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Eclipse Foundation Eclipse Kura 0.7.0 ~ 5.6.2 -

II. Public POCs for CVE-2026-114359

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-114359

请登录查看更多情报信息。

Other References for CVE-2026-114359 (2)

IV. Related Vulnerabilities

Same product: Eclipse Kura
Same vendor: Eclipse Foundation
Same weakness: CWE-770