EUVD-2026-72341
GHSA-j5p2-2hh2-r977
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local FIFO access requires granted Control Interface privilege (PR:L); no confidentiality or integrity impact; agent abort causes high availability loss.
Primary rating from Vendor (eclipse).
CVSS VectorVendor: eclipse
Lifecycle Timeline
4DescriptionCVE.org
In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a workload in a length-delimited protobuf message received through the Control Interface FIFO. A workload granted Control Interface access can specify an excessive message length, causing an unbounded memory allocation that may abort the Ankaios agent process. This results in loss of orchestration services for workloads managed by the affected agent.
AnalysisAI
Uncontrolled memory allocation in Eclipse Ankaios 0.1.0-1.0.1 allows a workload with granted Control Interface access to abort the agent process by declaring an arbitrarily large protobuf message length over the Control Interface FIFO, causing unbounded heap allocation and an OOM-triggered process crash. The impact is complete loss of orchestration services for all workloads managed by the affected agent instance. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacking workload must have been explicitly granted Control Interface access by an Ankaios operator - this is a deliberate, non-default configuration step. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 6.8 (Medium) with vector AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L is well-calibrated. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Eclipse Ankaios v1.0.2, which adds explicit message size validation for Control Interface input (PR #791: 'Add message size check for Control Interface input'). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Eclipse Ankaios
View allShare
External POC / Exploit Code
Leaving vuln.today