Is CVE-2026-97402 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-97402 being exploited in the wild.

How severe is CVE-2026-97402?

Informational severity, published 10 November 2026.

Is there a fix for CVE-2026-97402?

No fixed version is recorded yet. Do not install or enable the iBeacon and Eddystone scanner components unless BLE beacon scanning is required for your deployment. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-97402 attacked?

It is attacked from the adjacent network, in a hosted service.

Am I affected by CVE-2026-97402?

Check whether you run Eclipse Kura at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-97402: Eclipse Kura BLE advertisement decoder infinite loop

CVE-2026-97402 · Severity: info · Published 2026-11-10

Eclipse Kura is an IoT gateway platform that processes Bluetooth Low Energy (BLE) beacon signals. An attacker within BLE radio range can broadcast a specially crafted two-byte beacon advertisement that causes the gateway's CPU to peg at 100% and stop processing legitimate beacons until the gateway restarts. The vulnerability only affects systems with the iBeacon or Eddystone scanner components installed and enabled, which are not enabled by default.

Technologies: Eclipse Kura. Vendors: Eclipse.

Quick answers

Is CVE-2026-97402 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-97402 being exploited in the wild.
How severe is CVE-2026-97402?: Informational severity, published 10 November 2026.
Which products and versions are affected?: Eclipse Kura 3.1.0 to 5.6.2.
Is there a fix for CVE-2026-97402?: No fixed version is recorded yet. Do not install or enable the iBeacon and Eddystone scanner components unless BLE beacon scanning is required for your deployment.</anigation> </invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-97402 attacked?: It is attacked from the adjacent network, in a hosted service.
Am I affected by CVE-2026-97402?: Check whether you run Eclipse Kura at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Do not install or enable the iBeacon and Eddystone scanner components unless BLE beacon scanning is required for your deployment.</anigation> </invoke>

Technical details

The iBeacon and Eddystone advertisement decoders in Kura 3.1.0 to 5.6.2 incorrectly parse the AD-structure length field in BLE advertising payloads, triggering an infinite loop (CWE-835) combined with unexpected sign extension (CWE-194). An unauthenticated attacker with BLE radio proximity can transmit a two-byte malformed payload that drives the beacon-scanner thread into this loop, pinning a CPU core. Recovery requires gateway restart since beacon ingestion halts permanently.

Affected products

Eclipse Kura 3.1.0 to 5.6.2

Timeline

2026-11-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.