{"id":"CVE-2026-89295","published":"2026-11-03T14:17:39.480","lastModified":"2026-11-03T16:13:23.003","description":"In Eclipse Mnestix AAS Generator versions 0.1.0 up until but excluding 1.5.0, a practical upper bound on the client-supplied count parameter of the GET /api/v1/IdGenerator/submodelIds/{count} and GET /api/v2/IdGenerator/submodelIds/{count} endpoints is not enforced. The service generates and retains identifiers in memory before returning a response. A remote unauthenticated attacker can submit a large count to cause excessive memory consumption, potentially resulting in denial of service. Exploitation requires network access to the endpoint and successful retrieval of the ID-generation configuration from the configured backend repository.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-770"],"vendors":[],"products":[],"references":[{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/303","tags":[]},{"url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/774","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}