Skip to content
Sign in
6.8 Medium

CVE-2026-85201 In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a workload in a…

Description

In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a workload in a length-delimited protobuf message received through the Control Interface FIFO. A workload granted Control Interface access can specify an excessive message length, causing an unbounded memory allocation that may abort the Ankaios agent process. This results in loss of orchestration services for workloads managed by the affected agent.

Affected products and versions

Product Affected versions Fixed in
Eclipse Ankaios 0.1 0.1.0 → 1.0.1 No fix stated

Other CVEs of Eclipse Ankaios

The 4 CVEs of Eclipse Ankaios →
CVE-2026-92611 In Eclipse Ankaios versions 0.6.0 to before 1.0.4, `LogRule::matches` in the agent control-interface authorizer stops at… 4.8 Medium CVE-2026-86836 In Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload files and Control Interface named pipes… 8.4 High CVE-2026-84173 In Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Interface authorizer incorrectly evaluates… 8.3 High
Track this CVE