CVE-2026-63252

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-04 · updated 2026-10-23
Weakness: CWE-401

Description

In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message chunks when a channel disconnects, allowing a remote unauthenticated client to exhaust pooled direct memory by repeatedly sending incomplete chunks and disconnecting, potentially terminating the server.

Affected products

Eclipse Foundation Eclipse Milo: from 0.6.0 before 1.1.5 — fixed in 1.1.5

How to fix

Upgrade to a fixed version: Eclipse Foundation Eclipse Milo 1.1.5. Check the vendor advisory for mitigations.

References

https://github.com/eclipse-milo/milo/commit/459715793ec54b0f33367a14f94264500a0d872b
https://gitlab.eclipse.org/security/cve-assignment/-/work_items/179
https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/598

Get alerted when CVE-2026-63252 or the next vulnerability affects your stack