{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/iofog-controller-3.8.0---3.9.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:eclipse:iofog_controller:3.8.0:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:iofog_controller:3.9.1:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-113619"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["ioFog Controller (3.8.0 - 3.9.1)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Eclipse Foundation"],"content_html":"\u003cp\u003eEclipse ioFog Controller versions 3.8.0 through 3.9.1 contain a high-severity vulnerability (CVE-2026-113619) that permits unauthenticated denial-of-service (DoS) attacks. The flaw exists because the application utilizes the Liquid template engine to process request bodies for POST, PUT, and PATCH operations before enforcing authentication or role-based access control (RBAC).\u003c/p\u003e\n\u003cp\u003eThe security controls in place fail to properly validate bearer tokens or apply rate limiting to these specific routes. By sending a specially crafted, small JSON body, an anonymous attacker can cause the controller process to stall or abort. The resulting disruption impacts the availability of the entire control plane, including agent APIs and in-process WebSocket relays, rendering the ioFog environment unresponsive. Defenders should prioritize patching or implementing network-level access controls to limit access to vulnerable controller endpoints.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in the loss of control plane availability, effectively disabling management of connected ioFog agents and WebSocket-based telemetry relays. This vulnerability poses a significant risk to distributed edge computing environments relying on ioFog, as the control plane serves as the central orchestration point for fleet operations.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Eclipse ioFog Controller to a version beyond 3.9.1 once a patch is available.\u003c/li\u003e\n\u003cli\u003eUntil patching is feasible, implement network-level access control lists (ACLs) to restrict access to the ioFog Controller API to authorized management IP addresses only.\u003c/li\u003e\n\u003cli\u003eEnable web application firewall (WAF) or load balancer inspection to identify and block suspicious POST, PUT, and PATCH requests to the controller that contain excessive or malformed JSON payloads.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-20T14:17:33Z","date_published":"2026-10-20T14:17:33Z","id":"https://feed.craftedsignal.io/briefs/2026-10-iofog-controller-dos/","summary":"An unauthenticated denial-of-service vulnerability in Eclipse ioFog Controller (versions 3.8.0 through 3.9.1) allows attackers to crash the controller process by sending malicious JSON payloads to template-processing routes.","title":"Eclipse ioFog Controller: Denial of Service via Unauthenticated Liquid Template Processing (CVE-2026-113619)","url":"https://feed.craftedsignal.io/briefs/2026-10-iofog-controller-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - IoFog Controller (3.8.0 - 3.9.1)","version":"https://jsonfeed.org/version/1.1"}