CVE-2026-61387: Eclipse Milo

High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days.

In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server-global reservation is not restored. Deeply nested PubSub ExtensionObjects in a `CreateMonitoredItems` event filter can trigger a `StackOverflowError` during decoding, allowing an unauthenticated remote client to exhaust a finite global monitored-item quota and prevent all clients from creating new monitored items until restart. Existing monitored items and other server functions remain unaffected.

Affected products

• Eclipse Milo: from 1.0.0, before 1.1.5 (fixed in 1.1.5)

Published 2026-08-04. Last modified 2026-08-05.