CVE-2026-89295 Details

A denial-of-service vulnerability has been identified in Eclipse Mnestix AAS Generator versions 0.1.0 prior to 1.5.0. The issue arises because the application does not enforce a practical upper limit on the client-supplied count parameter for the GET /api/v1/IdGenerator/submodelIds/{count} and GET /api/v2/IdGenerator/submodelIds/{count} endpoints. This lack of restriction allows remote, unauthenticated attackers to submit large counts, causing excessive memory consumption. The service generates and holds identifiers in memory before sending a response, and exploitation of this vulnerability can lead to out-of-memory exceptions and service crashes. Successful exploitation requires network access to the endpoint and the retrieval of ID-generation configuration from the backend repository.

Users are advised to update to Eclipse Mnestix AAS Generator version 1.5.0 or later, where this vulnerability has been addressed.