Eclipse Mnestix AAS Generator: Denial of Service via parameter manipulation (CVE-2026-89295)
The Eclipse Mnestix AAS Generator fails to enforce an upper bound on identifier generation parameters, allowing remote unauthenticated attackers to cause denial of service via excessive memory consumption.
CVE search metadata
CVE search record: CVE-2026-89295. Severity: high. CVSS: 7.5. EPSS: 0.21%. KEV: no. Product: Mnestix AAS Generator (0.1.0 <= version < 1.5.0). Brief: Eclipse Mnestix AAS Generator: Denial of Service via parameter manipulation (CVE-2026-89295). Brief link: https://feed.craftedsignal.io/briefs/2026-11-eclipse-mnestix-dos/
Triage facts
Revision 1- Applicability
- Mnestix AAS Generator (0.1.0 <= version < 1.5.0)
- Evidence
- Unknown
- Severity
- Low
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 6, 21:29 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Eclipse Mnestix AAS Generator versions 0.1.0 through 1.4.x contain a vulnerability in the GET /api/v1/IdGenerator/submodelIds/{count} and GET /api/v2/IdGenerator/submodelIds/{count} endpoints. The application lacks an upper bound limit for the {count} parameter, causing the service to generate and hold an arbitrary number of identifiers in memory. Exploitation leads to a denial of service (DoS) due to memory exhaustion. Attackers require network access to the API and the ability to retrieve ID-generation configuration from the backend.
Impact
Successful exploitation causes excessive memory consumption, which may result in a crash or service unavailability for the Mnestix AAS Generator instance.
Recommendation
- Upgrade the Eclipse Mnestix AAS Generator to version 1.5.0 or later to ensure the count parameter is correctly validated and bounded.
- Implement rate limiting or request size validation at the API gateway or WAF level for the identified /api/v1/IdGenerator/submodelIds/ and /api/v2/IdGenerator/submodelIds/ endpoints.
- Audit logs for unusually high or erratic values in the {count} parameter segment of these URI paths.
Immediate actions
Patch affected Mnestix AAS Generator instances to version 1.5.0
Threat Hunt
Search web server logs for requests to /api/v1/IdGenerator/submodelIds/ or /api/v2/IdGenerator/submodelIds/ containing excessively large integers in the path.
Data: Web server access logs (cs-uri-stem)
Mitigations
Implement WAF rules to block or rate-limit requests to IdGenerator endpoints with count parameters exceeding expected business thresholds
CVE-2026-89295