EUVD-2026-104908Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach pre-auth OIDC endpoint over network
-
ExploitSend OIDC discovery/JWKS request
-
ExecutionSynchronous fetch blocks asyncio event loop
-
ImpactEntire service stalls (denial of service)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the Eclipse CSI PIA instance be network-reachable with its OIDC authentication flow enabled, since the vulnerable code path is the pre-authentication OIDC discovery and JWKS fetch logic. No credentials, user interaction, or special privileges are needed (PR:N/UI:N), and default OIDC-enabled deployments are affected. Limiting factors: the target must actually expose the OIDC endpoint to the attacker (deployments not using OIDC or firewalled from untrusted networks are not exposed), and the impact is confined to availability - a service stall - with no data exposure or code execution. |
| Impact | This is a moderate-severity availability-only denial-of-service issue (CVSS 4.0 base 6.9, vector AV:N/AC:L/AT:N/PR:N/UI:N with only VA:L and no confidentiality or integrity impact). The vector signals favor exploitability: network reachable, low complexity, no privileges (PR:N), and no user interaction, meaning a remote unauthenticated attacker can trigger it against the pre-authentication OIDC code path. However, the technical impact is limited - it is a transient service stall/resource-exhaustion condition (CWE-400), not code execution or data compromise, which is why impact is scored VA:L rather than VA:H. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization; the elevated 6.9 reflects easy triggering rather than severe consequence. Net assessment: a credible real but contained risk for operators running Eclipse CSI PIA as a reachable service, prioritized below RCE/auth-bypass classes. Note the 4.0 vector reports VA:L (low, not high) despite the description implying the 'whole service' stalls - verify with the vendor advisory whether a single request causes a full, sustained outage, which would argue for a higher availability impact. |
| Exploit ScenarioDerived | A remote unauthenticated attacker sends crafted or repeated OIDC discovery / JWKS requests to the exposed Eclipse CSI PIA endpoint; because these fetches execute synchronously on the asyncio event loop, each in-flight request blocks the loop and stalls all concurrent processing, denying service to legitimate users. No public exploit code is identified at time of analysis, but the pre-auth, low-complexity, no-interaction nature makes manual triggering trivial. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Eclipse CSI PIA executes its pre-authentication OIDC discovery and JWKS fetch operations synchronously directly on the asyncio event loop, so a single unauthenticated request can stall the entire service for every connected user. Any network-reachable deployment that has the OIDC authentication flow enabled is affected, and exploitation needs no credentials, privileges, or user interaction (CVSS 4.0 base 6.9, AV:N/AC:L/PR:N/UI:N, availability-only with VA:L). Impact is confined to denial of service with no confidentiality or integrity effect, and no public exploit code was identified at time of analysis.
RemediationAI
Apply the fixed release referenced in the Eclipse CSI PIA security advisory GHSA-jj77-2gc8-7pc6 (https://github.com/eclipse-csi/pia/security/advisories/GHSA-jj77-2gc8-7pc6); patch availability is confirmed per vendor advisory, but the exact fixed version is not enumerated in the supplied intelligence and must be verified against the advisory before rollout. If an immediate upgrade is not possible, front the service with a reverse proxy or API gateway that (a) enforces short upstream connect/read timeouts so a stalled OIDC fetch cannot hold a worker indefinitely, and (b) applies per-source-IP rate limits and concurrent-connection caps on the OIDC discovery and JWKS paths - the trade-off is added latency and the risk of throttling legitimate authentication bursts. Restricting /oidc discovery and JWKS endpoints to trusted identity-provider networks or VPN clients blocks the attack path entirely, at the cost of breaking external or federated clients that authenticate directly. Running multiple worker processes or replicas limits the blast radius of a single stalled event loop but does not eliminate the per-worker stall and increases resource consumption. Longer term, upstream should cache the discovery document and JWKS with a bounded TTL and move the fetches off the event loop (async HTTP client or run_in_executor) so a slow identity provider cannot serialize the service.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable component is the OpenID Connect integration inside Eclipse CSI PIA, which fetches the OIDC discovery document and the provider's JWKS (JSON Web Key Set) before an incoming request is authenticated. Those outbound HTTP calls are performed with blocking library code inside a coroutine instead of being offloaded with asyncio.to_thread/run_in_executor or an async HTTP client such as aiohttp/httpx. Because CPython's asyncio runs all tasks on a single thread, a blocking socket read suspends the loop itself: every other coroutine - in-flight requests, health probes, background tasks, and further OIDC fetches - is starved until the synchronous call returns or its socket timeout expires. An attacker can amplify this by issuing repeated unauthenticated requests to any endpoint that triggers the discovery/JWKS path, or by targeting a slow or unreachable identity provider so each fetch blocks for the full timeout. The weakness maps to CWE-400 (Uncontrolled Resource Consumption), realized here as event-loop resource exhaustion rather than memory or CPU exhaustion. The CPE cpe:2.3:a:eclipse_foundation:eclipse_csi_-_pia confirms the affected codebase is the Eclipse Foundation's PIA project; deployments without OIDC enabled, or firewalled from untrusted networks, never reach the vulnerable code path.
Know when Eclipse Csi Pia gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Remote pre-auth trigger over the network with no interaction gives AV:N/AC:L/PR:N/UI:N; impact is a transient service stall only, so C:N/I:N and A:L with scope unchanged.
Primary rating from Vendor (eclipse).
CVSS VectorVendor: eclipse
DescriptionCVE.org
Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Eclipse Csi Pia
View allServer-side request forgery in the Eclipse CSI PIA `POST /v1/upload/sbom` endpoint lets remote attackers coerce the serv
Server-side request forgery and OIDC token forgery in Eclipse CSI PIA lets an unauthenticated attacker abuse a flawed Je
Log injection in Eclipse CSI PIA's unauthenticated /v1/upload/sbom endpoint allows a remote attacker to plant forged aut
Blind server-side request forgery in Eclipse PIA allows an approved OIDC identity provider to force PIA's token-verifica
Exploit-DB