{"affected":[{"defaultStatus":"unaffected","product":"Eclipse Mnestix","source":"CNA: eclipse","vendor":"Eclipse Foundation","versions":[{"lessThan":"1.5.0","status":"affected","version":"0.1.0","versionType":"semver"}]}],"cveId":"CVE-2026-89295","cwes":["CWE-770"],"description":"In Eclipse Mnestix AAS Generator versions 0.1.0 up until but excluding 1.5.0, a practical upper bound on the client-supplied count parameter of the GET /api/v1/IdGenerator/submodelIds/{count} and GET /api/v2/IdGenerator/submodelIds/{count} endpoints is not enforced. The service generates and retains identifiers in memory before returning a response. A remote unauthenticated attacker can submit a large count to cause excessive memory consumption, potentially resulting in denial of service. Exploitation requires network access to the endpoint and successful retrieval of the ID-generation configuration from the configured backend repository.","epss":null,"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793712636745,"publishedAt":1793712636745,"references":[{"source":"CNA: eclipse","tags":[],"url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/774"},{"source":"CNA: eclipse","tags":[],"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/303"}],"remediation":[],"revision":"dfc320ba5d092c67f542718536b748d289bc8dd732d4d810e4c40a16182c3cb8","sources":[{"modifiedAt":1793712636745,"name":"CNA: eclipse","retrievedAt":1793715012278,"url":"https://www.cve.org/CVERecord?id=CVE-2026-89295"}],"ssvc":null,"status":"published","title":"Unauthenticated memory-exhaustion denial of service in Eclipse Mnestix AAS Generator unbounded count parameter","updatedAt":1793715012278}