EUVD-2026-41326
GHSA-qwmm-q68h-5qf6
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote, pre-session, unauthenticated and low-complexity (AV:N/AC:L/PR:N/UI:N) with availability-only impact from memory exhaustion (A:H, C/I:N), no scope change.
Primary rating from Vendor (ENISA).
CVSS VectorVendor: ENISA
Lifecycle Timeline
1DescriptionCVE.org
An unauthenticated remote attacker can exhaust server memory via the GetEndpoints Discovery Service in open62541. The endpointUrl field of GetEndpointsRequest is not validated for length. An attacker can declare an arbitrarily large string (up to ~4.09 GB via the UInt32 length field) delivered across intermediate chunks without ever sending the final chunk. The server buffers all chunks in RAM indefinitely until the SecureChannel times out. The attack is pre-session and bypasses all encryption configurations.
The issue affects open62541: from 1.4.0 through 1.4.16, from 1.5.0 through 1.5.4, master.
AnalysisAI
Uncontrolled memory consumption in open62541's OPC UA Discovery Service allows a remote, unauthenticated attacker to crash or degrade servers by abusing the GetEndpoints request handling. Because the endpointUrl field length is never validated, an attacker can advertise a string up to ~4.09 GB and stream it across incomplete message chunks that the server buffers in RAM indefinitely until the SecureChannel times out, exhausting available memory. The flaw is pre-session and works against any encryption configuration; no public exploit is identified at time of analysis, and it is not listed in CISA KEV.
Technical ContextAI
open62541 is a widely used open-source C implementation of the OPC UA (IEC 62541) industrial machine-to-machine communication protocol, embedded in PLCs, gateways, SCADA components, and IIoT devices. The vulnerability lives in the OPC UA Secure Conversation (chunking) layer that precedes session establishment: OPC UA messages can be fragmented into chunks, and the GetEndpointsRequest carries an endpointUrl string whose length is encoded in a UInt32 length prefix. The root cause maps to CWE-770 (Allocation of Resources Without Limits or Throttling) - the server accepts and buffers an attacker-declared string length (up to ~4.09 GB, the UInt32 ceiling) and accumulates intermediate chunks in memory while waiting for a final chunk that is never sent. The affected CPE is cpe:2.3:a:open62541_project_/_o6_automation_gmbh:open62541, covering the standard library builds.
RemediationAI
Patch available per vendor advisory: upgrade open62541 to a fixed release incorporating pull request https://github.com/open62541/open62541/pull/8142 (fix commit d253818d6c5e870e1db0e360b18138c8bdc809ae); an exact tagged patched version was not provided in the input, so confirm the specific release (expected on the 1.4.x and 1.5.x branches) directly with the project before deploying. Because many affected systems are embedded, downstream device vendors must rebuild firmware against the patched library. Where immediate patching is not possible, apply compensating controls: restrict network reachability of the OPC UA Discovery/GetEndpoints endpoint (typically TCP 4840) to trusted management hosts via firewall or OT network segmentation, which prevents arbitrary clients from initiating the attack but breaks discovery for legitimate remote clients; lower the SecureChannel timeout so buffered chunks are released sooner, at the cost of dropping slow legitimate connections; and constrain per-process memory (e.g. cgroup/ulimit limits) so an exhausted server fails and restarts predictably rather than destabilizing the host, accepting that the OPC UA service still becomes unavailable during an attack.
Use-after-free in open62541 up to version 1.5.5 allows remote unauthenticated attackers to crash the OPC UA server's His
Remote memory exhaustion in open62541's FindServers Discovery Service lets an unauthenticated attacker crash or degrade
The package open62541/open62541 before 1.2.5, from 1.3-rc1 and before 1.3.1 are vulnerable to Denial of Service (DoS) du
Heap-based buffer overflow in open62541 up to version 1.5.5 allows local low-privileged attackers to corrupt heap memory
Use-after-free memory corruption in open62541's example client code allows a local low-privileged user to cause memory c
Null pointer dereference in open62541's client library (versions up to 1.5.5) allows a remote OPC UA server to crash a c
Same technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today