CVE-2026-114359

Eclipse Kura downloads deployment packages (DPs) from a remote URL without any limit on the size of the data it receives. A malicious or compromised HTTP(S) server, or an attacker able to tamper with a plain-HTTP download, can stream an arbitrarily large (or endless) response. Kura writes the response to local storage until the filesystem is full. On gateways the temporary directory is often a RAM-backed tmpfs, so this can also exhaust memory. The result is denial of service of the device: failed configuration persistence, failed logging and possible crashes of the framework or other services. The same missing size limit is present in the REST upload endpoint `POST /deploy/v2/_upload`, which copies the request body to the temporary directory with no limit. Workarounds: only install DPs from trusted HTTPS sources, restrict who can install packages (Web UI `kura.packages.admin` permission, REST `kura.permission.rest.deploy`, cloud DEPLOY-V2 access).

• CWE-770

• https://github.com/eclipse-kura/kura/security/advisories/GHSA-r8mm-3wcm-qmx4
• https://gitlab.eclipse.org/security/cve-assignment/-/work_items/481

Published

Nov 10, 2026

Last Modified

Nov 12, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-114353Hidden functionality (undocumented backdoor) in the root-pri…7
• CVE-2026-114354Missing authorization in the native binder service 'android.…8.6
• CVE-2026-114355OS command injection in the root-privileged 'hardware_monito…8.6
• CVE-2026-114356Missing authorization in the system-privileged 'DJIUpdateSer…7
• CVE-2026-114357Missing authentication for a critical function in the Androi…9.3
• CVE-2026-114358This vulnerability exists in the Radius Xenia M2M Platform d…9.3
• CVE-2026-11436A vulnerability was detected in Mage AI up to 0.9.79. This i…4.3
• CVE-2026-114361A vulnerability was detected in HarnessRouter up to 0.31.10.…5.6
• CVE-2026-114362A flaw has been found in HarnessRouter up to 0.31.12. This i…6.3
• CVE-2026-114364Improper neutralization of special elements used in an SQL c…9.8
• CVE-2026-114366An information disclosure vulnerability in the Qt Framework …2.3
• CVE-2026-114369Resource exhaustion vulnerability in the Qt Framework QWebSo…2.7