CVE-2026-112186

In Eclipse Kura versions 5.4.0 through 5.6.2, the Service Listing V1 REST API read the JSON body of every request into memory, with no limit on its size. The endpoints parse the body before they check whether the caller is authenticated. A remote attacker without valid credentials can therefore send a few dozen large JSON requests at the same time, exhaust the Java heap with an OutOfMemoryError, and cause a denial of service. Likewise, a remote attacker, can send a deeply nested JSON request and trigger a StackOverflowError because of an unbound recursion in Service Listing V1.