Eclipse Kura EUVD-2026-121410

Exploitation requires network reachability to the Eclipse Kura Service Listing V1 REST API on an affected gateway (versions 5.4.0 through 5.6.2); no authentication, user interaction, or non-default configuration is needed because the endpoints parse the request JSON body into memory before performing the authentication check, with no limit on body size or nesting depth. The practical limiting factor is exposure of the Kura REST management interface: if that interface is restricted to a trusted management network or not exposed to untrusted clients, the unauthenticated attack surface is correspondingly reduced. The two trigger variants are concretely described - concurrent oversized JSON bodies exhaust the Java heap (OutOfMemoryError), and a single deeply-nested JSON body causes unbounded recursion (StackOverflowError).

This is a genuine but bounded availability risk, not a high-CVSS-but-low-real-risk inflation. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated, low-complexity reach with no attack requirements, and the description corroborates pre-authentication exploitation because the body is parsed before the caller's credentials are checked - the network-vector and no-privilege signals are mutually consistent here, not conflicting. Impact is strictly availability (VC:N/VI:N/VA:H, with SA:L indicating a limited knock-on availability effect on a subsequent system such as whatever the gateway services); there is no confidentiality or integrity exposure, so this is a denial-of-service issue only. No EPSS score, no CISA KEV listing, and no working exploit code were supplied, so there is no evidence of active exploitation; the vuln.today Decision label is 'this_week' (not act_now/emergency), which aligns with a readily-triggerable pre-auth DoS that is not yet known to be exploited in the wild. The net priority is moderate-to-elevated: easy to trigger and pre-auth, but the ceiling is service disruption rather than compromise, and real-world exposure depends on whether the Kura REST management interface is network-reachable to untrusted callers.

A remote attacker with no credentials reaches the Eclipse Kura Service Listing V1 REST endpoint and submits a few dozen concurrent requests carrying very large JSON bodies, which Kura reads entirely into the Java heap before authenticating, driving an OutOfMemoryError; alternatively a single deeply-nested JSON body triggers unbounded recursion and a StackOverflowError. Either path crashes or hangs the gateway's management service, denying availability. No public exploit identified at time of analysis - the references are the Eclipse security advisory and CVE-assignment records, not exploit code.