# CVE-2026-112186: Eclipse Kura Service Listing V1 unauthenticated denial of service

Source: https://junglewise.ai/threats/cve-2026-112186-in-eclipse-kura-versions-5-4-0-through-5-6-2-the-service-listing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-112186 · Severity: info · Published 2026-11-10

Eclipse Kura is a Java framework for building IoT edge devices and gateways. Attackers without authentication can send specially crafted HTTP requests to the Service Listing V1 REST API to exhaust server memory and crash the application, disrupting device operations. This can be exploited remotely with no credentials required.

Technologies: [Eclipse Kura](https://junglewise.ai/threats/technologies/eclipse-kura). Vendors: [Eclipse](https://junglewise.ai/threats/vendors/eclipse).

## Quick answers

**Is CVE-2026-112186 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-112186 being exploited in the wild.

**How severe is CVE-2026-112186?** Informational severity, published 10 November 2026.

**Which products and versions are affected?** Eclipse Kura 5.4.0 through 5.6.2.

**Is there a fix for CVE-2026-112186?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-112186 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-112186?** Check whether you run Eclipse Kura at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Service Listing V1 REST API in Kura parses JSON request bodies before checking authentication, allowing unauthenticated attackers to trigger denial of service via two mechanisms: sending multiple large JSON payloads to exhaust the Java heap (OutOfMemoryError), or sending deeply nested JSON to trigger uncontrolled recursion and a StackOverflowError. The vulnerability stems from missing input size limits and authentication ordering (CWE-696, CWE-770, CWE-674).

## Affected products

- Eclipse Kura 5.4.0 through 5.6.2

## Timeline

- 2026-11-10: disclosed

## References

- [https://github.com/eclipse-kura/kura/security/advisories/GHSA-pwq4-h95h-5634](https://github.com/eclipse-kura/kura/security/advisories/GHSA-pwq4-h95h-5634)
- [https://gitlab.eclipse.org/security/cve-assignment/-/work_items/429](https://gitlab.eclipse.org/security/cve-assignment/-/work_items/429)

## Related threats

- [Eclipse Kura Web Console session exhaustion denial of service](https://junglewise.ai/threats/cve-2026-97891-in-eclipse-kura-version-5-0-0-to-5-6-2-the-web-console-allocates)
- [Eclipse Kura privilege escalation in CommandCloudApp ZIP extraction](https://junglewise.ai/threats/cve-2026-97401-in-kura-versions-5-6-2-commandcloudapp-execute-extracts-a-caller)
- [Eclipse Kura Configuration REST API authorization bypass](https://junglewise.ai/threats/cve-2026-112185-in-eclipse-kura-versions-5-1-0-through-5-6-2-the-configuration)
- [Eclipse Kura path traversal in command file-upload handler](https://junglewise.ai/threats/cve-2026-111729-in-kura-versions-5-6-2-the-command-file-upload-handler-at-post)
- [Eclipse Kura BLE advertisement decoder infinite loop](https://junglewise.ai/threats/cve-2026-97402-in-eclipse-kura-versions-3-1-0-to-5-6-2-the-ibeacon-and-eddystone)