HIGH

CVE-2026-63252

Eclipse Milo 2026-08-04 CVSS v3.1

CVSS

7.5

Description

In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message chunks when a channel disconnects, allowing a remote unauthenticated client to exhaust pooled direct memory by repeatedly sending incomplete chunks and disconnecting, potentially terminating the server.

Weakness (CWE)

CWE-401 Memory Leak

EPSS Score

0.42%

Probability of exploitation in next 30 days

36.1th percentile

References

https://github.com/eclipse-milo/milo/commit/459715793ec54b0f33367a14f94264500a0d872b Patch https://gitlab.eclipse.org/security/cve-assignment/-/work_items/179 Issue Tracking, Patch, Vendor Advisory https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/598 Issue Tracking, Vendor Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE