Riskcovery

CVE-2026-85201

State
Published
Severity
6.8 Medium
Published
Sep 7, 2026
Updated
Sep 8, 2026
Reserved
Sep 3, 2026

Read the record on cve.org

Description

In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a workload in a length-delimited protobuf message received through the Control Interface FIFO. A workload granted Control Interface access can specify an excessive message length, causing an unbounded memory allocation that may abort the Ankaios agent process. This results in loss of orchestration services for workloads managed by the affected agent.

Scores

CVSSScoreVectorSource
4.06.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:Leclipse

Weaknesses

  • CWE-789 Memory allocation with excessive size value
  • CWE-1284 Improper validation of specified quantity in input

Affected Products

ProductVersions
Eclipse AnkaiosEclipse Foundation
  • 0.1.0 through 1.0.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.