Vulnerability · Published Nov 3, 2026 · Assigned by eclipse
CVE-2026-89295Unauthenticated memory-exhaustion denial of service in Eclipse Mnestix AAS Generator unbounded count parameter
Unrated
In plain English
A resource allocation without limits in Eclipse Mnestix from Eclipse Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).
Official description
In Eclipse Mnestix AAS Generator versions 0.1.0 up until but excluding 1.5.0, a practical upper bound on the client-supplied count parameter of the GET /api/v1/IdGenerator/submodelIds/{count} and GET /api/v2/IdGenerator/submodelIds/{count} endpoints is not enforced. The service generates and retains identifiers in memory before returning a response. A remote unauthenticated attacker can submit a large count to cause excessive memory consumption, potentially resulting in denial of service. Exploitation requires network access to the endpoint and successful retrieval of the ID-generation configuration from the configured backend repository.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Eclipse Foundation | Eclipse Mnestix | 0.1.0 – before 1.5.0 |
Weakness: CWE-770