Quick answers
- Is CVE-2026-114359 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-114359 being exploited in the wild.
- How severe is CVE-2026-114359?
- Informational severity, published 10 November 2026.
- Which products and versions are affected?
- Eclipse Kura.
- Is there a fix for CVE-2026-114359?
- No fixed version is recorded yet. Only install deployment packages from trusted HTTPS sources. Restrict who can install packages using Web UI kura.packages.admin permission, REST kura.permission.rest.deploy, or cloud DEPLOY-V2 access controls. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-114359 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-114359?
- Check whether you run Eclipse Kura. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Only install deployment packages from trusted HTTPS sources. Restrict who can install packages using Web UI kura.packages.admin permission, REST kura.permission.rest.deploy, or cloud DEPLOY-V2 access controls.
Technical details
Kura fails to enforce size limits when downloading deployment packages (DPs) from a remote URL or when accepting uploads via the REST endpoint POST /deploy/v2/_upload. An attacker with network access to a plain-HTTP download or control of the HTTP(S) server can stream unlimited data that Kura writes to local storage (often RAM-backed tmpfs), exhausting memory or disk and crashing services.
Affected products
- Eclipse Kura
Timeline
- 2026-11-10: disclosed