{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/mnestix-aas-generator-0.1.0--version--1.5.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:eclipse:mnestix_aas_generator:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-89295"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Mnestix AAS Generator (0.1.0 \u003c= version \u003c 1.5.0)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Eclipse Foundation"],"content_html":"\u003cp\u003eEclipse Mnestix AAS Generator versions 0.1.0 through 1.4.x contain a vulnerability in the GET /api/v1/IdGenerator/submodelIds/{count} and GET /api/v2/IdGenerator/submodelIds/{count} endpoints. The application lacks an upper bound limit for the {count} parameter, causing the service to generate and hold an arbitrary number of identifiers in memory. Exploitation leads to a denial of service (DoS) due to memory exhaustion. Attackers require network access to the API and the ability to retrieve ID-generation configuration from the backend.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation causes excessive memory consumption, which may result in a crash or service unavailability for the Mnestix AAS Generator instance.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the Eclipse Mnestix AAS Generator to version 1.5.0 or later to ensure the count parameter is correctly validated and bounded.\u003c/li\u003e\n\u003cli\u003eImplement rate limiting or request size validation at the API gateway or WAF level for the identified /api/v1/IdGenerator/submodelIds/ and /api/v2/IdGenerator/submodelIds/ endpoints.\u003c/li\u003e\n\u003cli\u003eAudit logs for unusually high or erratic values in the {count} parameter segment of these URI paths.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-06T21:29:36Z","date_published":"2026-11-06T21:29:36Z","id":"https://feed.craftedsignal.io/briefs/2026-11-eclipse-mnestix-dos/","summary":"The Eclipse Mnestix AAS Generator fails to enforce an upper bound on identifier generation parameters, allowing remote unauthenticated attackers to cause denial of service via excessive memory consumption.","title":"Eclipse Mnestix AAS Generator: Denial of Service via parameter manipulation (CVE-2026-89295)","url":"https://feed.craftedsignal.io/briefs/2026-11-eclipse-mnestix-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Mnestix AAS Generator (0.1.0 \u003c= Version \u003c 1.5.0)","version":"https://jsonfeed.org/version/1.1"}