CVE-2026-89295

{"id": "CVE-2026-89295", "cveTags": [], "metrics": {}, "affected": [{"source": "emo@eclipse.org", "affectedData": [{"vendor": "Eclipse Foundation", "product": "Eclipse Mnestix", "versions": [{"status": "affected", "version": "0.1.0", "lessThan": "1.5.0", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-11-03T14:17:39.480", "references": [{"url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/303", "source": "emo@eclipse.org"}, {"url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/774", "source": "emo@eclipse.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "emo@eclipse.org", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "In Eclipse Mnestix AAS Generator versions 0.1.0 up until but excluding 1.5.0, a practical upper bound on the client-supplied count parameter of the GET /api/v1/IdGenerator/submodelIds/{count} and GET /api/v2/IdGenerator/submodelIds/{count} endpoints is not enforced. The service generates and retains identifiers in memory before returning a response. A remote unauthenticated attacker can submit a large count to cause excessive memory consumption, potentially resulting in denial of service. Exploitation requires network access to the endpoint and successful retrieval of the ID-generation configuration from the configured backend repository."}], "lastModified": "2026-11-03T16:13:23.003", "sourceIdentifier": "emo@eclipse.org"}