{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-89295","assignerOrgId":"e51fbebd-6053-4e49-959f-1b94eeb69a2c","state":"PUBLISHED","assignerShortName":"eclipse","dateReserved":"2026-09-11T12:51:25.114Z","datePublished":"2026-11-03T13:30:36.745Z","dateUpdated":"2026-11-03T13:30:36.745Z"},"containers":{"cna":{"providerMetadata":{"orgId":"e51fbebd-6053-4e49-959f-1b94eeb69a2c","shortName":"eclipse","dateUpdated":"2026-11-03T13:30:36.745Z"},"title":"Unauthenticated memory-exhaustion denial of service in Eclipse Mnestix AAS Generator unbounded count parameter","problemTypes":[{"descriptions":[{"lang":"en","cweId":"CWE-770","description":"CWE-770 Allocation of resources without limits or throttling","type":"CWE"}]}],"affected":[{"vendor":"Eclipse Foundation","product":"Eclipse Mnestix","versions":[{"status":"affected","version":"0.1.0","lessThan":"1.5.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"descriptions":[{"lang":"en","value":"In Eclipse Mnestix AAS Generator versions 0.1.0 up until but excluding 1.5.0, a practical upper bound on the client-supplied count parameter of the GET /api/v1/IdGenerator/submodelIds/{count} and GET /api/v2/IdGenerator/submodelIds/{count} endpoints is not enforced. The service generates and retains identifiers in memory before returning a response. A remote unauthenticated attacker can submit a large count to cause excessive memory consumption, potentially resulting in denial of service. Exploitation requires network access to the endpoint and successful retrieval of the ID-generation configuration from the configured backend repository.","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>In Eclipse Mnestix AAS Generator versions 0.1.0 up until but excluding 1.5.0, a practical upper bound on the client-supplied count parameter of the GET /api/v1/IdGenerator/submodelIds/{count} and GET /api/v2/IdGenerator/submodelIds/{count} endpoints is not enforced. The service generates and retains identifiers in memory before returning a response. A remote unauthenticated attacker can submit a large count to cause excessive memory consumption, potentially resulting in denial of service. Exploitation requires network access to the endpoint and successful retrieval of the ID-generation configuration from the configured backend repository.</p>"}]}],"references":[{"url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/774"},{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/303"}],"credits":[{"lang":"en","value":"Eclipse Foundation Security Team","type":"finder"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.5"}}}}