---
id: CVE-2026-89295
title: >-
  Unauthenticated memory-exhaustion denial of service in Eclipse Mnestix AAS
  Generator unbounded count parameter
summary: >-
  In Eclipse Mnestix AAS Generator versions 0.1.0 up until but excluding 1.5.0,
  a practical upper bound on the client-supplied count parameter of the GET
  /api/v1/IdGenerator/submodelIds/{count} and GET
  /api/v2/IdGenerator/submodelIds/{coun…
severity: none
cwe:
  - CWE-770
vendor: Eclipse Foundation
product: Eclipse Mnestix
affected:
  - eclipse_mnestix >= 0.1.0 < 1.5.0
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T13:30:36.745Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89295'
references:
  - url: 'https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/774'
  - url: 'https://gitlab.eclipse.org/security/cve-assignment/-/work_items/303'
tags:
  - cve.org
epss: 0.00211
epssPercentile: 0.11456
ingestedAt: '2026-11-05T19:30:42.948Z'
---

## Overview

In Eclipse Mnestix AAS Generator versions 0.1.0 up until but excluding 1.5.0, a practical upper bound on the client-supplied count parameter of the GET /api/v1/IdGenerator/submodelIds/{count} and GET /api/v2/IdGenerator/submodelIds/{count} endpoints is not enforced. The service generates and retains identifiers in memory before returning a response. A remote unauthenticated attacker can submit a large count to cause excessive memory consumption, potentially resulting in denial of service. Exploitation requires network access to the endpoint and successful retrieval of the ID-generation configuration from the configured backend repository.

## Affected

- `eclipse_mnestix >= 0.1.0 < 1.5.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.