Threats tagged 'ghsa-mgqh-hxfv-cf6h'

Eclipse Kura versions 5.4.0 through 5.6.2 contain a vulnerability in the Service Listing V1 REST API where the JSON body of every request is read into memory without size limits. The API parses the body before authenticating the caller, allowing unauthenticated remote attackers to send multiple large or deeply nested JSON requests. This can exhaust the Java heap memory causing an OutOfMemoryError or trigger a StackOverflowError due to unbounded recursion, resulting in denial of service.