Denial of Service Vulnerability in Eclipse Kura by Eclipse Foundation

CVE-2026-114359

What is CVE-2026-114359?

Eclipse Kura contains a vulnerability that permits the download of deployment packages (DPs) from remote URLs without imposing any size restrictions. This flaw enables malicious actors to exploit vulnerable servers, potentially allowing them to stream excessively large or indefinite responses. As Kura writes these responses to local storage, it risks overwhelming the filesystem and exhausting memory resources, leading to denial of service. This can result in failed configuration persistence, disrupted logging capabilities, and potential system crashes. Similar vulnerabilities exist within the REST upload endpoint, which also lacks size limitations.

References