CVE-2026-63252

HIGH

Eclipse Milo UASC Server Missing Message Chunk Release Denial of Service

Generated titleSource: EIP title enrichment
STIX 2.1 vulnerability

Record summary

CVE-2026-63252 has a selected CVSS score of 8.7 (high).

Description

In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message chunks when a channel disconnects, allowing a remote unauthenticated client to exhaust pooled direct memory by repeatedly sending incomplete chunks and disconnecting, potentially terminating the server.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 4, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Eclipse Milo

Browse Eclipse Foundation / Eclipse Milo

Default status: unaffected

CVE List0.6.0 to ≤ 1.1.4affected

References

4