CVE-2026-85201In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a workload in a length-delimited protobuf message received through the Control Interface FIFO.
Updated under an hour ago ()
Does this affect you?
It affects Eclipse Foundation Eclipse Ankaios. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a workload in a length-delimited protobuf message received through the Control Interface FIFO. A workload granted Control Interface access can specify an excessive message length, causing an unbounded memory allocation that may abort the Ankaios agent process. This results in loss of orchestration services for workloads managed by the affected agent.
- CVSS
- 6.8 MEDIUM (v4.0, CNA)CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
- Weakness (CWE)
- CWE-789, CWE-1284
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- eclipse
- NVD analysis
- Deferred
- Record last updated
- Sep 8, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Eclipse Foundation Eclipse Ankaios eclipse_foundation:eclipse_ankaios (from the name) | from 0.1.0 through 1.0.1 | CNA record |
References
- https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/900
- https://github.com/eclipse-ankaios/ankaios/releases/tag/v1.0.2
- https://github.com/eclipse-ankaios/ankaios/pull/791
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.