Session Management Flaw in Eclipse Kura Affects Web Console Functionality

CVE-2026-97891

What is CVE-2026-97891?

In certain versions of Eclipse Kura, a flaw in the Web Console allows for the allocation of unlimited HTTP sessions for requests to authentication endpoints without proper checks. This vulnerability enables an unauthenticated user to exploit the session management logic, leading to potential exhaustion of the JVM heap memory, which can result in the Kura process crashing. The lack of session limits poses a critical risk, particularly in scenarios where malicious actors can send repeated requests, effectively disrupting service availability.

References