Vulnpedia
← All CVEs

CVE-2026-89321

MEDIUM 4.3 ALL-YEARS

Published 2026-09-14 · Last modified 2026-09-14 · eclipse · NVD: Awaiting Analysis

Publishing limits the compressed size of a VSIX (ovsx.publishing.max-content-size, 512 MB by default) but nothing limited how large an entry becomes when opened. On the first request to /vscode/unpkg/{namespace}/{extension}/{version}/{path}, WebResourceService opened the entry with ZipFile.getInputStream() and passed the decompressed stream to Files.copy(), which ran to the end of the stream without counting bytes written. The result was cached under java.io.tmpdir, and that cache evicted by entry count (150), not by size, so it placed no bound on disk usage. A publisher with access only to their own namespace could therefore upload a small, highly compressible VSIX and cause the server to write far larger files to the temp filesystem — repeating with different files or versions, since a repeat request is served from the cache. Impact observed: the temp filesystem filled; requests for files not already cached returned 500 with No space left on device; a failed extraction left a partial cache file that blocked later attempts at that path; publishing failed with Failed to read extension file. Metadata and already-cached files kept working, and the server did not stop. Triggering the extraction needs no authentication — only the upload does.

LIMITED SIGNALS

No known exploitation, public exploit, or elevated probability at this time. Track for changes.

Exploitation likelihood

0.4%chance of exploitation in 30 days · 37th percentile

○ In CISA KEV○ Public exploit / PoC◆ SSVC: exploitation none, automatable no

Impact if exploited

4.3CVSS 3.1 · MEDIUM · CNA

  • ConfidentialityNone
  • IntegrityNone
  • AvailabilityLow

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ⚠Privileges: Requires a low-privilege account
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept & exploit code

No public exploit or proof-of-concept code is catalogued for this CVE (no ExploitDB, Nuclei, or CISA-KEV entry). It may still exist — search GitHub or check the references below.

Affected

Vendors Eclipse Foundation

Products Eclipse Openvsx

Weakness (CWE)

  • CWE-409: Improper handling of highly compressed data (data amplification)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

All CVSS metrics

  • MEDIUM 4.3 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
  • MEDIUM 4.3 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

References

Technical & other

Sources: NVD · CVE.org · EPSS