Eclipse Kura EUVD-2026-121146

Requires an account with package-install authority - Web UI kura.packages.admin permission, REST kura.permission.rest.deploy, or cloud DEPLOY-V2 access (PR:L) - and the ability to influence the download source: a malicious or compromised HTTP(S) server, or a man-in-the-middle position on a plain-HTTP download. The same unbounded-copy flaw is reachable via the REST endpoint POST /deploy/v2/_upload, which writes the request body to the temporary directory with no size limit. Limiting factors: exploitation is authenticated (not anonymous), depends on the operator fetching from or being pointed at an untrusted/tamperable source, and no user interaction by a victim is needed. Impact is amplified on gateways where the temporary directory is a RAM-backed tmpfs, allowing memory as well as disk exhaustion.

This is a moderate-priority, availability-only issue rather than a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H, 7.0 High) is internally consistent with the description: network-reachable, low complexity, but requiring low privileges (PR:L - an account with package-install rights) and an attack requirement (AT:P - the attacker must control, compromise, or MITM the download source). Impact is purely denial of service (VA:H plus SA:H for downstream services/framework); there is no confidentiality or integrity exposure. The decision label is 'this_week', not 'act_now' or 'emergency', which matches the signal picture: no CISA KEV listing, no EPSS score supplied, and no public exploit referenced. The exploitation status is therefore 'no public exploit identified at time of analysis'. The main tension to flag: the vector is AV:N yet exploitation is gated behind an authenticated install permission and control over the fetched content, so real-world risk is bounded by who can install deployment packages and whether downloads use untrusted or plain-HTTP sources. No key data is internally conflicting, but EPSS, KEV, and fixed-version data are simply absent from the input and cannot be confirmed here.

An actor holding Kura's package-install permission (Web UI kura.packages.admin, REST kura.permission.rest.deploy, or cloud DEPLOY-V2) directs the gateway to fetch a deployment package from a malicious or compromised HTTP(S) server - or tampers with a plain-HTTP download in transit. The server streams an arbitrarily large or endless response, which Kura writes to local (often RAM-backed tmpfs) storage until the filesystem or memory is exhausted, crashing framework services. No public exploit code is referenced in the available sources.