Eclipse Kura: Denial of service via session exhaustion in Web Console
Summary
In Eclipse Kura versions 5.0.0 to 5.6.2, the Web Console creates a new HTTP session for every request to its authentication endpoints (/admin/auth, /admin/login/password, /admin/login/cert) before checking the HTTP method or the credentials, and it does not limit the number of sessions. An unauthenticated remote attacker who sends requests to these endpoints without reusing the returned session cookie can exhaust the JVM heap and crash the Kura process. No credentials are required.
Affected
- Eclipse Kura 5.0.0 to 5.6.2
- Affected component: Web Console authentication endpoints
Fixed in
Unknown. Eclipse Kura 5.6.3 (November 2026) is the likely fixed release, but the vendor advisory has not yet confirmed this for this CVE.
Workaround
- Unknown. No vendor-documented workaround found.
- Restrict access to the Web Console to management networks or a VPN.
- Place a reverse proxy or firewall with rate limits and connection caps in front of the login endpoints.
Exploitation
Unknown. No public proof-of-concept and no known exploitation in the wild were found at the time of research. The trigger is simple, so exploitation is likely easy.
Our recommendation
- Check whether Kura Web Consoles are reachable from the internet and remove that exposure.
- Plan an upgrade to Eclipse Kura 5.6.3 or later once the vendor advisory confirms the fix.
- Monitor JVM heap usage and the service status, and configure automatic restart of the Kura service.
- Verify the advisory and the CVE record for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-4pwp-99h8-c44j github.com
- Eclipse CVE assignment work item #325 gitlab.eclipse.org
- Eclipse Kura 5.6.3 release github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 18:22.
Original description (NVD)
In Eclipse Kura version 5.0.0 to 5.6.2, the Web Console allocates a new HTTP session for every request to its built-in authentication endpoints (/admin/auth, /admin/login/password, /admin/login/cert) before checking the HTTP method, parsing the request, or validating any submitted credentials, and does not limit how many such sessions can be allocated. An unauthenticated client that sends requests to these endpoints without honoring the returned session cookie can cause the server to allocate an unbounded number of sessions, exhausting the JVM heap and crashing the Kura process.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.