Eclipse Milo
Approved changes feed: RSS · Atom
cpe:2.3:a:eclipse_foundation:eclipse_milo:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Eclipse Foundation (2c315c48-0111-5572-bbde-cc70cfafb2e9) |
|---|---|
| Product | Eclipse Milo (38b3d0dd-6a22-5dcc-ae92-73651bfe5c54) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-62927 |
vulnerable | 2026-09-16 04:32:52.385357 |
Details available
In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization, allowing an anonymous or otherwise low-privileged client to execute a denied method by batching it with an allowed method.
Published: 2026-08-04T11:57:59.822Z
Updated: 2026-08-04T15:02:34.431Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-63252 |
vulnerable | 2026-09-16 04:32:49.714820 |
Details available
In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message chunks when a channel disconnects, allowing a remote unauthenticated client to exhaust pooled direct memory by repeatedly sending incomplete chunks and disconnecting, potentially terminating the server.
Published: 2026-08-04T12:03:18.647Z
Updated: 2026-08-04T15:02:26.923Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-63248 |
vulnerable | 2026-09-16 04:32:49.583210 |
Details available
In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization. An anonymous client can enable diagnostics over a None/None endpoint without a certificate; with a trusted client application certificate over SignAndEncrypt, it can read security diagnostics for other active sessions, exposing usernames, login history, authentication mechanisms, security modes and policies, and public client certificates.
Published: 2026-08-04T12:07:43.820Z
Updated: 2026-08-04T15:02:13.054Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-61387 |
vulnerable | 2026-09-16 04:32:44.983951 |
Details available
In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server-global reservation is not restored. Deeply nested PubSub ExtensionObjects in a `CreateMonitoredItems` event filter can trigger a `StackOverflowError` during decoding, allowing an unauthenticated remote client to exhaust a finite global monitored-item quota and prevent all clients from creating new monitored items until restart. Existing monitored items and other server functions remain unaffected.
Published: 2026-08-04T11:52:38.259Z
Updated: 2026-08-04T15:02:51.029Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-60007 |
vulnerable | 2026-09-16 04:32:44.312599 |
Details available
In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim's `Basic128Rsa15`-encrypted username token to use repeated unauthenticated `ActivateSession` requests as a padding oracle, recover the victim's password, and authenticate with the recovered credentials.
Published: 2026-08-04T11:55:41.934Z
Updated: 2026-08-04T15:02:43.092Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-58080 |
vulnerable | 2026-09-16 04:32:42.832372 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.