CWE-194 vulnerabilities

Eclipse Kura versions 3.1.0 through 5.6.2 contain a vulnerability in the iBeacon and Eddystone advertisement decoders where the AD-structure length field of BLE advertising payloads is improperly parsed. An unauthenticated attacker within BLE range can send a crafted two-byte advertising payload that causes the beacon-scanner thread to enter an infinite loop, consuming a CPU core and halting beacon ingestion until the gateway is restarted. This attack requires the iBeacon/Eddystone scanner component to be installed and active, which is not the default configuration.