CVE-2026-61387 in Milo
Summary
by MITRE • 08/04/2026
In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server-global reservation is not restored. Deeply nested PubSub ExtensionObjects in a `CreateMonitoredItems` event filter can trigger a `StackOverflowError` during decoding, allowing an unauthenticated remote client to exhaust a finite global monitored-item quota and prevent all clients from creating new monitored items until restart. Existing monitored items and other server functions remain unaffected.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/04/2026
The vulnerability exists within Eclipse Milo versions 1.0.0 through 1.1.4 where the monitored-item quota accounting mechanism lacks exception safety measures. This flaw stems from improper resource management during monitored item creation processes, specifically when dealing with unchecked exceptions that occur during the decoding of PubSub ExtensionObjects within CreateMonitoredItems event filters. The system maintains a global reservation pool for monitored items that serves all connected clients, and when unchecked errors interrupt this process, the reservation accounting fails to properly restore the consumed quota back to the global pool.
The technical exploitation pathway involves crafting deeply nested PubSub ExtensionObjects within event filters that trigger StackOverflowError during decoding operations. This particular error condition occurs because the decoding logic does not implement proper recursion depth limits or exception handling mechanisms when processing complex nested structures. When such malformed data reaches the monitored item creation endpoint, the unchecked StackOverflowError prevents the normal cleanup procedures from executing, leaving the global quota reservation in an inconsistent state where the reserved slots are effectively consumed but never released back to the available pool.
The operational impact of this vulnerability represents a denial-of-service condition that specifically targets the server's ability to accept new monitored item requests. An unauthenticated remote client can systematically exhaust the finite global monitored-item quota by repeatedly submitting maliciously crafted requests that trigger the StackOverflowError condition. Once the quota is depleted, no legitimate client can create new monitored items until the server is manually restarted, which disrupts normal operations and potentially affects critical monitoring functions. The vulnerability does not compromise existing monitored items or other server functionalities, meaning that ongoing operations continue unaffected while new creation requests are blocked entirely.
This weakness maps directly to CWE-404, which addresses improper resource management and exception safety in software systems, and aligns with ATT&CK technique T1499.004 for network denial of service through resource exhaustion attacks. The vulnerability demonstrates poor error handling practices that violate fundamental security principles of graceful degradation and resource accounting. Organizations should implement immediate mitigations including upgrading to patched versions of Eclipse Milo, implementing rate limiting on monitored item creation requests, and adding proper exception handling with resource cleanup mechanisms. Additionally, input validation and depth limits on nested object structures should be enforced to prevent recursive decoding scenarios that could trigger StackOverflowError conditions, ensuring that the global quota accounting system remains resilient against malformed data inputs.