{"id":"CVE-2026-89295","title":"Unauthenticated memory-exhaustion denial of service in Eclipse Mnestix AAS Generator unbounded count parameter","summary":"In Eclipse Mnestix AAS Generator versions 0.1.0 up until but excluding 1.5.0, a practical upper bound on the client-supplied count parameter of the GET /api/v1/IdGenerator/submodelIds/{count} and GET /api/v2/IdGenerator/submodelIds/{coun…","severity":"none","cwe":["CWE-770"],"vendor":"Eclipse Foundation","product":"Eclipse Mnestix","affected":["eclipse_mnestix >= 0.1.0 < 1.5.0"],"published":"2026-11-03","updated":"2026-11-03","sourceUpdated":"2026-11-03T13:30:36.745Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89295","references":[{"url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/774"},{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/303"}],"tags":["cve.org"],"epss":0.00211,"epssPercentile":0.11456,"ingestedAt":"2026-11-05T19:30:42.948Z","slug":"CVE-2026-89295","body":"## Overview\n\nIn Eclipse Mnestix AAS Generator versions 0.1.0 up until but excluding 1.5.0, a practical upper bound on the client-supplied count parameter of the GET /api/v1/IdGenerator/submodelIds/{count} and GET /api/v2/IdGenerator/submodelIds/{count} endpoints is not enforced. The service generates and retains identifiers in memory before returning a response. A remote unauthenticated attacker can submit a large count to cause excessive memory consumption, potentially resulting in denial of service. Exploitation requires network access to the endpoint and successful retrieval of the ID-generation configuration from the configured backend repository.\n\n## Affected\n\n- `eclipse_mnestix >= 0.1.0 < 1.5.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}