CVE-2026-63252 is a high-severity vulnerability (CVSS 8.7) affecting Eclipse Milo versions 0.6.0 through 1.1.4. The issue arises because UASC server transport handlers fail to release retained partial message chunks when a channel disconnects. An unauthenticated remote attacker can exploit this by repeatedly sending incomplete message chunks and disconnecting, leading to exhaustion of pooled direct memory and potentially terminating the server process. This is classified as a CWE-401 (Improper Release of Memory Before Removing References). There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

The vulnerability allows a remote unauthenticated attacker to cause a denial of service by exhausting server memory resources, potentially terminating the server. This could disrupt availability of services relying on Eclipse Milo.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider limiting exposure of the affected service to untrusted networks and monitoring for abnormal connection patterns that may indicate exploitation attempts.