In Eclipse ioFog Controller versions 3.8.0 to 3.9.1, request bodies that trigger Liquid template substitution are rendered by an uncapped Liquid engine before the system verifies authentication or enforces role‑based access control. The rendering occurs for POST, PUT, and PATCH requests, and a minimal JSON payload can stall or terminate the controller process. The unauthenticated caller receives no rendered output, but the exception is that the controller itself becomes unavailable, disrupting the control plane, agent APIs, and in‑process WebSocket relays.

The vulnerability affects all Eclipse ioFog Controller releases from 3.8.0 through 3.9.1. Every route that performs template substitution is susceptible regardless of authentication status, so any installation using those versions is exposed.

The CVSS base score of 7.5 reflects the significant availability impact. Because the bearer token check does not reject missing or invalid tokens, an unauthenticated attacker can send crafted POST, PUT, or PATCH requests to the vulnerable routes. The controller can be overloaded due to the unbounded rendering engine, choking the control plane without authentication or privileged credentials. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, indicating no publicly confirmed exploits at the time of this analysis.