CVE-2026-114359

Eclipse Kura downloads deployment packages DPs from a remote URL without any limit on the size of the data it receives. A malicious or compromised HTTPS server, or an attacker able to tamper with a plain-HTTP download, can stream an arbitrarily large or endless response. Kura writes the response ...