CVE-2026-113619: CWE-400 in Eclipse Foundation Eclipse ioFog

In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, the handling of POST, PUT, and PATCH request bodies on routes that enable template substitution uses an uncapped Liquid template engine before authentication and role-based access control (RBAC) are enforced. The bearer token check does not reject missing or invalid tokens, and rate limiting applies only to login routes. This allows an unauthenticated attacker to send crafted JSON bodies that cause the Liquid engine to stall or abort the Controller process, resulting in denial of service. The anonymous caller does not receive the rendered output, so confidentiality and integrity are not impacted. The impact is limited to availability of the control plane, including the agent API and WebSocket relays running in the same process.

The vulnerability leads to denial of service by stalling or aborting the Eclipse ioFog Controller process, impacting availability of the control plane and agent API. There is no impact on confidentiality or integrity. The attacker does not need authentication and can cause service disruption remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Eclipse ioFog Controller API to trusted networks and monitor for unusual POST, PUT, or PATCH requests on routes that enable template substitution. Consider implementing external rate limiting or WAF rules to mitigate abuse of unauthenticated endpoints.