Eclipse Mnestix AAS Generator memory exhaustion can stop the service
Anyone can send large requests to an ID tool and stop it.
Summary
The ID generation API in Eclipse Mnestix AAS Generator does not enforce a practical upper bound on the requested count. An unauthenticated remote attacker can send a large count to exhaust memory and stop the service; versions from 0.1.0 up to but excluding 1.5.0 are affected.
Affected when
- network access to the endpoint
- ID-generation configuration retrievable from the configured backend repository
What to do
Check that you run a version newer than 1.5.0, and read the vendor's advisory.
Products and platforms
CVE IDs
Times
First published
First seen