Eclipse Kura has a vulnerability where it downloads deployment packages (DPs) from remote URLs without limiting the size of the data received. This can allow an attacker controlling the server or tampering with HTTP downloads to cause the device to exhaust local storage or memory, leading to denial of service conditions such as failed configuration persistence, failed logging, and potential crashes of the framework or other services. The REST upload endpoint also lacks size limits on uploads. Workarounds include restricting package installation to trusted HTTPS sources and limiting who can install packages via permissions.