CVE-2026-61387

7.5 HIGHpublic exploit available

Published 2026-08-04 · Updated 2026-08-05

AI risk analysis

Summary: The flaw allows an unauthenticated remote client to exhaust monitored-item quotas by triggering a `StackOverflowError` during PubSub ExtensionObject decoding, leading to denial of service for monitored item creation.
Exploitability: Exploitation requires sending deeply nested PubSub ExtensionObjects in a `CreateMonitoredItems` event filter; preconditions include the target running Eclipse Milo version 1.0.0 through 1.1.4.
Blast radius: If exploited, this could significantly impact server availability by preventing all clients from creating new monitored items until a restart is performed.
Prioritized remediation: Upgrade to Eclipse Milo versions later than 1.1.4 or apply vendor patches immediately.

dospubsubremote-exploitquota-exhaustion

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server-global reservation is not restored. Deeply nested PubSub ExtensionObjects in a `CreateMonitoredItems` event filter can trigger a `StackOverflowError` during decoding, allowing an unauthenticated remote client to exhaust a finite global monitored-item quota and prevent all clients from creating new monitored items until restart. Existing monitored items and other server functions remain unaffected.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-400, CWE-460, CWE-772

Vendors

eclipse

Products

milo

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.