# CVE-2026-114359: Eclipse Kura unrestricted deployment package download size

Source: https://junglewise.ai/threats/cve-2026-114359-eclipse-kura-downloads-deployment-packages-dps-from-a-remote-url  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-114359 · Severity: info · Published 2026-11-10

Eclipse Kura is an IoT gateway framework that manages device configuration and deployments. An attacker can exploit missing size limits on deployment package downloads to stream arbitrarily large data to the device, exhausting disk or memory storage and causing denial of service—preventing legitimate configuration updates, logging, and framework operation.

Technologies: [Eclipse Kura](https://junglewise.ai/threats/technologies/eclipse-kura). Vendors: [Eclipse](https://junglewise.ai/threats/vendors/eclipse).

## Quick answers

**Is CVE-2026-114359 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114359 being exploited in the wild.

**How severe is CVE-2026-114359?** Informational severity, published 10 November 2026.

**Which products and versions are affected?** Eclipse Kura.

**Is there a fix for CVE-2026-114359?** No fixed version is recorded yet. Only install deployment packages from trusted HTTPS sources. Restrict who can install packages using Web UI kura.packages.admin permission, REST kura.permission.rest.deploy, or cloud DEPLOY-V2 access controls. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-114359 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-114359?** Check whether you run Eclipse Kura. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Only install deployment packages from trusted HTTPS sources. Restrict who can install packages using Web UI kura.packages.admin permission, REST kura.permission.rest.deploy, or cloud DEPLOY-V2 access controls.

## Technical details

Kura fails to enforce size limits when downloading deployment packages (DPs) from a remote URL or when accepting uploads via the REST endpoint POST /deploy/v2/_upload. An attacker with network access to a plain-HTTP download or control of the HTTP(S) server can stream unlimited data that Kura writes to local storage (often RAM-backed tmpfs), exhausting memory or disk and crashing services.

## Affected products

- Eclipse Kura

## Timeline

- 2026-11-10: disclosed

## References

- [https://github.com/eclipse-kura/kura/security/advisories/GHSA-r8mm-3wcm-qmx4](https://github.com/eclipse-kura/kura/security/advisories/GHSA-r8mm-3wcm-qmx4)
- [https://gitlab.eclipse.org/security/cve-assignment/-/work_items/481](https://gitlab.eclipse.org/security/cve-assignment/-/work_items/481)

## Related threats

- [Eclipse Kura Web Console session exhaustion denial of service](https://junglewise.ai/threats/cve-2026-97891-in-eclipse-kura-version-5-0-0-to-5-6-2-the-web-console-allocates)
- [Eclipse Kura privilege escalation in CommandCloudApp ZIP extraction](https://junglewise.ai/threats/cve-2026-97401-in-kura-versions-5-6-2-commandcloudapp-execute-extracts-a-caller)
- [Eclipse Kura Service Listing V1 unauthenticated denial of service](https://junglewise.ai/threats/cve-2026-112186-in-eclipse-kura-versions-5-4-0-through-5-6-2-the-service-listing)
- [Eclipse Kura Configuration REST API authorization bypass](https://junglewise.ai/threats/cve-2026-112185-in-eclipse-kura-versions-5-1-0-through-5-6-2-the-configuration)
- [Eclipse Kura path traversal in command file-upload handler](https://junglewise.ai/threats/cve-2026-111729-in-kura-versions-5-6-2-the-command-file-upload-handler-at-post)