Threats tagged 'ghsa-55xq-3854-rm9w'

Eclipse Mnestix AAS Generator versions 0.1.0 up to but excluding 1.5.0 do not enforce an upper limit on the client-supplied count parameter in certain API endpoints. This allows a remote unauthenticated attacker with network access to submit a large count value, causing excessive memory consumption and potential denial of service. Exploitation requires access to the ID-generation configuration from the backend repository.