Memory Exhaustion Vulnerability in Eclipse Mnestix AAS Generator

CVE-2026-89295

What is CVE-2026-89295?

A memory exhaustion vulnerability exists in Eclipse Mnestix AAS Generator that allows an unauthenticated remote attacker to exploit the client-supplied count parameter on specific API endpoints. This flaw permits the attacker to request excessively large identifiers, leading to significant memory consumption. As the service generates and retains these identifiers in memory, it can ultimately result in denial of service for legitimate users if the resource limit is reached. Network access to the endpoint is required for exploitation, and successful attacks necessitate prior retrieval of the ID-generation configuration from the connected backend repository.

References