CVE-2026-89295
Received Received - Intake

Resource Exhaustion in Eclipse Mnestix AAS Generator

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: Eclipse Foundation

Description
In Eclipse Mnestix AAS Generator versions 0.1.0 up until but excluding 1.5.0, a practical upper bound on the client-supplied count parameter of the GET /api/v1/IdGenerator/submodelIds/{count} and GET /api/v2/IdGenerator/submodelIds/{count} endpoints is not enforced. The service generates and retains identifiers in memory before returning a response. A remote unauthenticated attacker can submit a large count to cause excessive memory consumption, potentially resulting in denial of service. Exploitation requires network access to the endpoint and successful retrieval of the ID-generation configuration from the configured backend repository.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-89295
EUVD
EUVD-2026-115818

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Eclipse Foundation Eclipse Mnestix 0.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-89295 is an unauthenticated memory-exhaustion denial of service vulnerability in Eclipse Mnestix AAS Generator versions 0.1.0 to 1.4.9. It occurs in the GET /api/v1/IdGenerator/submodelIds/{count} and GET /api/v2/IdGenerator/submodelIds/{count} endpoints where the count parameter is unbounded. Attackers can send a large count value causing the service to generate and retain excessive identifiers in memory, leading to system crashes due to memory exhaustion.

Detection Guidance

Monitor for excessive memory usage or crashes in the Eclipse Mnestix AAS Generator service. Check logs for GET requests to /api/v1/IdGenerator/submodelIds/{count} or /api/v2/IdGenerator/submodelIds/{count} with unusually large count values (e.g., 4294967295). Use network monitoring tools to detect large payloads or repeated requests to these endpoints.

Impact Analysis

This vulnerability allows remote unauthenticated attackers to crash the Eclipse Mnestix AAS Generator service by sending a single malicious request with a large count value. The impact is limited to service availability as the system may become unresponsive or crash due to out-of-memory errors. The attack requires network access to the vulnerable endpoints and a reachable backend repository.

Mitigation Strategies

Upgrade to Eclipse Mnestix AAS Generator version 1.5.0 or later. Implement input validation to enforce a maximum limit on the count parameter (e.g., cap at 1000). Disable or restrict access to the vulnerable endpoints via network policies or firewall rules. Review and update authentication handlers to prevent implicit admin privileges for GET requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89295. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...