CVE-2026-85201 Details
Description
In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a workload in a length-delimited protobuf message received through the Control Interface FIFO. A workload granted Control Interface access can specify an excessive message length, causing an unbounded memory allocation that may abort the Ankaios agent process. This results in loss of orchestration services for workloads managed by the affected agent.
A vulnerability in the Eclipse Ankaios agent, affecting versions 0.1.0 through 1.0.1, allows workloads to cause unbounded memory allocation by specifying excessive message lengths in length-delimited protobuf messages. This flaw arises because the agent's Control Interface FIFO reader does not validate the length of incoming messages, leading to an allocation based on an unbounded size value. As a result, the Ankaios agent process may be aborted, disrupting orchestration services for managed workloads.
Users can upgrade to Eclipse Ankaios version 1.0.2, which includes a fix for this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 7, 2026CISA-ADP
Assessed Sep 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/eclipse-ankaios/ankaios/pull/791 | [email protected] | Issue TrackingVendor |
| https://github.com/eclipse-ankaios/ankaios/releases/tag/v1.0.2 | [email protected] | Release NotesVendor |
| https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/900 | [email protected] | AdvisoryIssue TrackingVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1284 | Improper Validation of Specified Quantity in Input | [email protected] |
| CWE-789 | Memory Allocation with Excessive Size Value | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Eclipse Ankaios | >= 0.1.0, <= 1.0.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 8, 2026 | CVE Modified | CISA-ADP |
| Sep 7, 2026 | New CVE Received | [email protected] |