{"metadata": {"vulnerability": "CVE-2026-112186", "count": 11, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 5}, "linked_omitted": 0}, "data": [{"timestamp": "2026-10-19T09:21:22.208Z", "date_only": false, "value": "2026-10-19T09:21:22.208Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-112186", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-10T17:02:46.279Z", "date_only": false, "value": "2026-11-10T17:02:46.279Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-112186", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-10T17:02:46.279Z", "date_only": false, "value": "2026-11-10T17:02:46.279Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-112186", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-10T17:02:46.279Z", "date_only": false, "value": "2026-11-10T17:02:46.279Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / eclipse", "record": "CVE-2026-112186", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-10T17:10:34.529Z", "date_only": false, "value": "2026-11-10T17:10:34.529151Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117593252433023118", "record": "CVE-2026-112186", "field": "creation_timestamp", "uuid": "1f61edca-9c54-4b01-bde1-93fa8cf146ed", "content": "CVE-2026-112186  In Eclipse Kura versions 5.4.0 through 5.6.2, the Service Listing V1 REST API read the JSON body of every request into memory, with no limit on its size. The endpoints parse the body before they check whether the caller is authenticated. A remote attacker without valid credentials can therefore send a few dozen large JSON requests at the same time, exhaust the Java heap with an `OutOfMemoryError`, and cause a denial of service. Likewise, a remote attacker, can send a deeply nested JSON request and trigger a `StackOverflowError` because of an unbound recursion in Service Listing V1.\nhttps://www.cve.org/CVERecord?id=CVE-2026-112186https://github.com/eclipse-kura/kura/security/advisories/GHSA-pwq4-h95h-5634https://gitlab.eclipse.org/security/cve-assignment/-/work_items/429#eclipse #EclipseFoundation #EclipseKura#CVE_2026_112186#bot", "url": "https://infosec.exchange/users/cve/statuses/117593252433023118"}, {"timestamp": "2026-11-10T17:17:20Z", "date_only": false, "value": "2026-11-10T17:17:20Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-MGQH-HXFV-CF6H", "record": "GHSA-MGQH-HXFV-CF6H", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-10T17:17:20.850Z", "date_only": false, "value": "2026-11-10T17:17:20.850", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-112186", "record": "FKIE_CVE-2026-112186", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-10T17:17:20.850Z", "date_only": false, "value": "2026-11-10T17:17:20.850", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-112186", "record": "FKIE_CVE-2026-112186", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-10T18:02:24.647Z", "date_only": false, "value": "2026-11-10T18:02:24.647343Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/5lw6yywar2vfb", "record": "CVE-2026-112186", "field": "creation_timestamp", "uuid": "605482bf-5e9d-49f6-be3e-7edd4a98e9f9", "content": "CVE-2026-112186 - Eclipse Kura Service Listing API Denial of Service Vulnerability\nCVE ID : CVE-2026-112186\n \n Published : Nov. 10, 2026, 5:02 p.m. | 13\u00a0minutes ago\n \n Description : In Eclipse Kura versions 5.4.0 through 5.6.2, the Service Listing V1 REST API read the JSON bod...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/5lw6yywar2vfb"}, {"timestamp": "2026-11-10T18:31:44Z", "date_only": false, "value": "2026-11-10T18:31:44Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-MGQH-HXFV-CF6H", "record": "GHSA-MGQH-HXFV-CF6H", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-10T18:31:44Z", "date_only": false, "value": "2026-11-10T18:31:44Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-MGQH-HXFV-CF6H", "record": "GHSA-MGQH-HXFV-CF6H", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-10T23:23:56.517Z", "anchors": {"origin": {"timestamp": "2026-11-10T17:02:46.279Z", "date_only": false, "value": "2026-11-10T17:02:46.279Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-112186", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-10T17:02:46.279Z", "date_only": false, "value": "2026-11-10T17:02:46.279Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-112186", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 22870.238512, "hours": 6.352844031111111, "days": 0.26470183462962965, "min_seconds": 22870.238512, "max_seconds": 22870.238512, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-10T17:02:46.279Z", "date_only": false, "value": "2026-11-10T17:02:46.279Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-112186", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-10T23:23:56.517Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}