CVE-2026-89295: Eclipse Foundation Eclipse Mnestix, отказ на услуга

Описание

Оригинално описание

In Eclipse Mnestix AAS Generator versions 0.1.0 up until but excluding 1.5.0, a practical upper bound on the client-supplied count parameter of the GET /api/v1/IdGenerator/submodelIds/{count} and GET /api/v2/IdGenerator/submodelIds/{count} endpoints is not enforced. The service generates and retains identifiers in memory before returning a response. A remote unauthenticated attacker can submit a large count to cause excessive memory consumption, potentially resulting in denial of service. Exploitation requires network access to the endpoint and successful retrieval of the ID-generation configuration from the configured backend repository.

Засегнати продукти

• Eclipse Foundation Eclipse Mnestix: 0.1.0 преди 1.5.0

Вид слабост

• CWE-770 Allocation of Resources Without Limits or Throttling

История

Други уязвимости в Eclipse Foundation Eclipse Mnestix

• 8.8CVE-2026-89293
• 9.2CVE-2026-89292

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-89295
• https://nvd.nist.gov/vuln/detail/CVE-2026-89295
• https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/774
• https://gitlab.eclipse.org/security/cve-assignment/-/work_items/303