CVE-2026-113619
Awaiting Analysis Awaiting Analysis - Queue

ioFog Controller Liquid Template Engine Denial of Service

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: Eclipse Foundation

Description
In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes that enable template substitution are rendered by an uncapped Liquid engine before authentication and RBAC. The bearer check does not reject a missing or invalid token, and the auth rate limit applies only to user login routes. A small JSON body can stall or abort the Controller process. The anonymous caller does not receive the rendered result; the impact is availability of the control plane, including the agent API and in-process WebSocket relays on that process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-11-09
AI Q&A
2026-10-20
EPSS Evaluated
2026-11-08
NVD
CVE-2026-113619
EUVD
EUVD-2026-104987

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Eclipse Foundation Eclipse ioFog 3.8.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Eclipse ioFog Controller versions 3.8.0 through 3.9.1. It allows unauthenticated attackers to send specially crafted JSON payloads to routes that use Liquid template substitution. The engine processes these payloads before authentication checks, consuming excessive CPU or memory and causing the Controller process to stall or crash. This leads to a denial-of-service condition for the control plane.

Detection Guidance

Monitor for unusual CPU or memory spikes on the ioFog Controller host, especially after receiving POST, PUT, or PATCH requests to routes with template substitution. Check for stalled or crashed Controller processes. Inspect network traffic for small JSON payloads sent to port 51121 targeting affected routes.

Impact Analysis

The impact includes disruption of the entire edge fleet's control plane functionality. This affects REST API access, agent status monitoring, and WebSocket channels. The system may become unresponsive or crash entirely, halting operations dependent on the Controller process.

Compliance Impact

This vulnerability primarily impacts availability of the control plane, which could disrupt access to systems handling sensitive data. While it does not directly expose data, prolonged downtime may interfere with logging, monitoring, or audit functions required by GDPR and HIPAA. Compliance could be affected if the DoS condition prevents timely access to protected health or personal data.

Mitigation Strategies

Upgrade to ioFog Controller version 3.9.2 or later once available. Temporarily block or restrict access to port 51121 from untrusted networks. Disable or audit routes enabling Liquid template substitution until patched. Monitor for anomalous resource usage.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113619. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...