Infinite Loop Vulnerability in Eclipse Kura Beacon Scanners

CVE-2026-97402

What is CVE-2026-97402?

In Eclipse Kura versions 3.1.0 to 5.6.2, an issue arises from improper parsing of the AD-structure length field in BLE advertising payloads. When an unauthenticated attacker within BLE range broadcasts a crafted two-byte advertising payload, it can initiate an infinite loop in the Kura beacon-scanner thread. This results in a severe degradation of performance, as a CPU core becomes stuck, effectively halting beacon data processing until the system is restarted. The attack can occur only if the iBeacon/Eddystone scanner component is deployed and active, which is not the default state.

References