Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-61387

Uncontrolled Monitored-Item Quota Exhaustion via StackOverflow in Eclipse Milo

In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server-global reservation is not restored. Deeply nested PubSub ExtensionObjects in a `CreateMonitoredItems` event filter can trigger a `StackOverflowError` during decoding, allowing an unauthenticated remote client to exhaust a finite global monitored-item quota and prevent all clients from creating new monitored items until restart. Existing monitored items and other server functions remain unaffected.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Eclipse Milo Milo
CVE-2026-60007

Padding Oracle in Eclipse Milo Reveals Passwords

In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim's `Basic128Rsa15`-encrypted username token to use repeated unauthenticated `ActivateSession` requests as a padding oracle, recover the victim's password, and authenticate with the recovered credentials.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Eclipse Milo Milo
CVE-2026-63252

Memory Exhaustion via Unreleased Partial Message Chunks in Eclipse Milo

In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message chunks when a channel disconnects, allowing a remote unauthenticated client to exhaust pooled direct memory by repeatedly sending incomplete chunks and disconnecting, potentially terminating the server.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Eclipse Milo Milo