{"metadata": {"vulnerability": "CVE-2026-114359", "count": 11, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 5}, "linked_omitted": 0}, "data": [{"timestamp": "2026-10-21T08:51:35.079Z", "date_only": false, "value": "2026-10-21T08:51:35.079Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-114359", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-10T14:23:54.141Z", "date_only": false, "value": "2026-11-10T14:23:54.141Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-114359", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-10T14:23:54.141Z", "date_only": false, "value": "2026-11-10T14:23:54.141Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-114359", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-10T14:23:54.141Z", "date_only": false, "value": "2026-11-10T14:23:54.141Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / eclipse", "record": "CVE-2026-114359", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-10T14:43:11.174Z", "date_only": false, "value": "2026-11-10T14:43:11.174165Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117592672576793945", "record": "CVE-2026-114359", "field": "creation_timestamp", "uuid": "ac49c1ca-98e8-4044-b0f3-12648772c23f", "content": "CVE-2026-114359  Eclipse Kura downloads deployment packages (DPs) from a remote URL without any limit on the size of the data it receives. A malicious or compromised HTTP(S) server, or an attacker able to tamper with a plain-HTTP download, can stream an arbitrarily large (or endless) response. Kura writes the response to local storage until the filesystem is full. On gateways the temporary directory is often a RAM-backed tmpfs, so this can also exhaust memory. The result is denial of service of the device: failed configuration persistence, failed logging and possible crashes of the framework or other services.\nThe same missing size limit is present in the REST upload endpoint `POST /deploy/v2/_upload`, which copies the request body to the temporary directory with no limit.\nWorkarounds: only install DPs from trusted HTTPS sources, restrict who can install packages (Web UI `kura.packages.admin` permission, REST `kura.permission.rest.deploy`, cloud DEPLOY-V2 access).\nhttps://www.cve.org/CVERecord?id=CVE-2026-114359https://github.com/eclipse-kura/kura/security/advisories/GHSA-r8mm-3wcm-qmx4https://gitlab.eclipse.org/security/cve-assignment/-/work_items/481#eclipse #EclipseFoundation #EclipseKura#CVE_2026_114359#bot", "url": "https://infosec.exchange/users/cve/statuses/117592672576793945"}, {"timestamp": "2026-11-10T15:17:12Z", "date_only": false, "value": "2026-11-10T15:17:12Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-V72C-73R8-WFX2", "record": "GHSA-V72C-73R8-WFX2", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-10T15:17:12.933Z", "date_only": false, "value": "2026-11-10T15:17:12.933", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-114359", "record": "FKIE_CVE-2026-114359", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-10T15:17:12.933Z", "date_only": false, "value": "2026-11-10T15:17:12.933", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-114359", "record": "FKIE_CVE-2026-114359", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-10T15:33:37Z", "date_only": false, "value": "2026-11-10T15:33:37Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-V72C-73R8-WFX2", "record": "GHSA-V72C-73R8-WFX2", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-10T15:33:37Z", "date_only": false, "value": "2026-11-10T15:33:37Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-V72C-73R8-WFX2", "record": "GHSA-V72C-73R8-WFX2", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-10T16:02:27.761Z", "date_only": false, "value": "2026-11-10T16:02:27.761441Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/7n6myhkzo4nfi", "record": "CVE-2026-114359", "field": "creation_timestamp", "uuid": "e39b7161-7957-4217-8a23-228c19d19233", "content": "CVE-2026-114359 - Eclipse Kura Denial of Service via Unrestricted Resource Consumption\nCVE ID : CVE-2026-114359\n \n Published : 10 Nov 2026, 2:23 p.m. | 1\u00a0hour, 3\u00a0minutes ago\n \n Description : Eclipse Kura downloads deployment packages (DPs) from a remote URL without any limit o...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/7n6myhkzo4nfi"}], "metrics": {"as_of": "2026-11-11T11:09:31.941Z", "anchors": {"origin": {"timestamp": "2026-11-10T14:23:54.141Z", "date_only": false, "value": "2026-11-10T14:23:54.141Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-114359", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-10T14:23:54.141Z", "date_only": false, "value": "2026-11-10T14:23:54.141Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-114359", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 74737.800221, "hours": 20.76050006138889, "days": 0.8650208358912037, "min_seconds": 74737.800221, "max_seconds": 74737.800221, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-10T14:23:54.141Z", "date_only": false, "value": "2026-11-10T14:23:54.141Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-114359", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-11T11:09:31.941Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}