Cpe:2.3:a:eclipse:mnestix_aas_generator:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aeclipsemnestix_aas_generator/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 06 Nov 2026 21:29:36 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgEclipse Mnestix AAS Generator: Denial of Service via parameter manipulation (CVE-2026-89295)https://feed.craftedsignal.io/briefs/2026-11-eclipse-mnestix-dos/Fri, 06 Nov 2026 21:29:36 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-eclipse-mnestix-dos/The Eclipse Mnestix AAS Generator fails to enforce an upper bound on identifier generation parameters, allowing remote unauthenticated attackers to cause denial of service via excessive memory consumption.Eclipse Mnestix AAS Generator versions 0.1.0 through 1.4.x contain a vulnerability in the GET /api/v1/IdGenerator/submodelIds/{count} and GET /api/v2/IdGenerator/submodelIds/{count} endpoints. The application lacks an upper bound limit for the {count} parameter, causing the service to generate and hold an arbitrary number of identifiers in memory. Exploitation leads to a denial of service (DoS) due to memory exhaustion. Attackers require network access to the API and the ability to retrieve ID-generation configuration from the backend.

Impact

Successful exploitation causes excessive memory consumption, which may result in a crash or service unavailability for the Mnestix AAS Generator instance.

Recommendation

  • Upgrade the Eclipse Mnestix AAS Generator to version 1.5.0 or later to ensure the count parameter is correctly validated and bounded.
  • Implement rate limiting or request size validation at the API gateway or WAF level for the identified /api/v1/IdGenerator/submodelIds/ and /api/v2/IdGenerator/submodelIds/ endpoints.
  • Audit logs for unusually high or erratic values in the {count} parameter segment of these URI paths.
]]>lowadvisory