Quick answers
- Is CVE-2026-85201 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-85201 being exploited in the wild.
- How severe is CVE-2026-85201?
- Informational severity, published 7 September 2026.
- Which products and versions are affected?
- Eclipse Ankaios 0.1.0 through 1.0.1.
- Is there a fix for CVE-2026-85201?
- A patch was published on 2026-09-04: Fixed in version 1.0.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-85201 attacked?
- It is attacked with local access.
- Am I affected by CVE-2026-85201?
- Check whether you run Eclipse Ankaios at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The Ankaios agent does not validate the length field declared by a workload in length-delimited protobuf messages received through the Control Interface FIFO. A malicious or misconfigured workload can specify an excessively large message length, triggering unbounded memory allocation that exhausts available memory and terminates the agent process. This is a resource exhaustion / denial-of-service vulnerability affecting the orchestration layer. The attack requires a workload to have Control Interface access, is network-reachable through the FIFO interface, and has been fixed in version 1.0.2 via message size validation checks.
Affected products
- Eclipse Ankaios 0.1.0 through 1.0.1
Timeline
- 2026-09-07: disclosed
- 2026-09-04: patched: Fixed in version 1.0.2