EUVD-2026-41256
GHSA-r94m-59fw-hm34
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach OPC UA discovery port
-
DeliveryOpen SecureChannel (pre-session)
-
ExploitSend FindServersRequest with oversized serverUris
-
ExecutionStream chunks, withhold final chunk
-
PersistServer buffers gigabytes in RAM
-
ImpactMemory exhaustion, denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only that the target expose the OPC UA Discovery Service - specifically the FindServers endpoint - to the attacker over the network; it occurs pre-session and before any security-policy/encryption negotiation, so no credentials, certificates, or user interaction are needed (AV:N/AC:L/PR:N/UI:N). The concrete trigger is a FindServersRequest with an oversized serverUris field (declared string up to ~3.9 GB) delivered across intermediate chunks with the final chunk withheld, causing indefinite chunk buffering until SecureChannel timeout. The main limiting factor is reachability: the affected versions (1.4.0-1.4.16, 1.5.0-1.5.4, master) must be running and the Discovery/FindServers service must be network-accessible to the attacker; deployments that keep OPC UA on isolated OT segments sharply reduce real-world exposure. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) is internally consistent with the description: network-reachable, low complexity, no privileges, no user interaction, and pure availability impact with no confidentiality or integrity loss. This is a genuine availability priority for exposed OPC UA endpoints because it is unauthenticated, pre-session, and unaffected by encryption/security-policy hardening - the usual OPC UA mitigations do not help. Tempering the urgency: there is no KEV listing, no EPSS score supplied, and no public exploit identified, so this is not confirmed as actively exploited; impact is limited to denial of service (no code execution or data exposure). The realistic exposure depends heavily on network placement - OPC UA servers are frequently intended to sit on segmented OT networks rather than the public internet, which constrains the practical AV:N reach. EPSS is not provided in the input and cannot be inferred. |
| Exploit ScenarioDerived | An attacker with network reachability to an OPC UA server opens a SecureChannel and sends a FindServersRequest whose serverUris field declares a multi-gigabyte string, then streams intermediate chunks while deliberately never sending the final chunk. The server buffers every chunk in RAM until the SecureChannel times out, and by opening several such connections the attacker drives the process into memory exhaustion and denial of service. No authentication, user interaction, or exploit tooling is required (no public POC identified), and low attack complexity makes the technique straightforward to script. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 02, 2026
Remote memory exhaustion in open62541's FindServers Discovery Service lets an unauthenticated attacker crash or degrade OPC UA servers built on versions 1.4.0-1.4.16, 1.5.0-1.5.4, and master. Because the serverUris field of a FindServersRequest is never validated for length or array size, an attacker can declare a string of up to ~3.9 GB and stream it across chunks while withholding the final chunk, forcing the server to buffer everything in RAM until the SecureChannel times out. The attack is pre-session, requires no authentication, and bypasses all encryption configuration; no public exploit identified at time of analysis.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - apply the fix from https://github.com/open62541/open62541/pull/8142 (change https://github.com/open62541/open62541/pull/8142/changes/d253818d6c5e870e1db0e360b18138c8bdc809ae) by upgrading to a build that includes it once a tagged 1.4.x/1.5.x release ships, or by cherry-picking the patch into your current build. Because exploitation is pre-session and unauthenticated, the most effective compensating control is network segmentation: restrict access to the OPC UA Discovery port (default TCP 4840) to trusted management/OT hosts only via firewall or ACLs, which prevents arbitrary clients from reaching FindServers but also blocks legitimate remote discovery clients. Additionally, lower the SecureChannel timeout so buffered chunks are released sooner (reducing the memory-hold window at the cost of dropping slow legitimate clients), place the server behind an OPC UA-aware proxy/gateway that enforces message-size limits, and monitor server memory to alert on the sustained growth this attack produces.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
open62541 is a widely used open-source C implementation of the OPC UA (IEC 62541) industrial machine-to-machine communication protocol, common in OT/IIoT gateways, PLCs, SCADA components, and edge devices. The flaw sits in the Discovery layer's FindServers service, which is reachable before a session (and before security handshakes) are established. OPC UA messages can be split into multiple chunks; here the server accepts an arbitrarily large declared string/array size in the serverUris field and accumulates incoming chunks in memory without bound. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): the decoder trusts the client-declared length, allowing a single connection to reserve/buffer memory far beyond any legitimate request until the SecureChannel timeout fires.
Know when Open62541 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated, pre-session, network-reachable trigger with low complexity gives AV:N/AC:L/PR:N/UI:N; impact is availability-only memory exhaustion, so C:N/I:N/A:H.
Primary rating from Vendor (ENISA).
CVSS VectorVendor: ENISA
DescriptionCVE.org
An unauthenticated remote attacker can exhaust server memory via the FindServers Discovery Service in open62541. The serverUris field of FindServersRequest is not validated for length or array size. An attacker can declare an arbitrarily large string (up to ~3.9 GB) delivered across intermediate chunks without ever sending the final chunk. The server buffers all chunks in RAM indefinitely until the SecureChannel times out. The attack is pre-session and bypasses all encryption configuration. The issue affects open62541: from 1.4.0 through 1.4.16, from 1.5.0 through 1.5.4, master.
Executive ViewAI
open62541 OPC UA library versions 1.4.0-1.4.16 and 1.5.0-1.5.4 are vulnerable to unauthenticated remote denial-of-service attacks via memory exhaustion in the FindServers Discovery Service, allowing attackers to crash or severely degrade server availability without authentication. No public exploit identified at time of analysis. Organizations deploying these versions face service availability risk from any network-connected attacker.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Use-after-free in open62541 up to version 1.5.5 allows remote unauthenticated attackers to crash the OPC UA server's His
An integer overflow in open62541's UA_DataType_fromStructureDescription() allows a malicious or compromised OPC UA serve
Uncontrolled memory consumption in open62541's OPC UA Discovery Service allows a remote, unauthenticated attacker to cra
The package open62541/open62541 before 1.2.5, from 1.3-rc1 and before 1.3.1 are vulnerable to Denial of Service (DoS) du
Heap-based buffer overflow in open62541 up to version 1.5.5 allows local low-privileged attackers to corrupt heap memory
Use-after-free memory corruption in open62541's example client code allows a local low-privileged user to cause memory c
Null pointer dereference in open62541's client library (versions up to 1.5.5) allows a remote OPC UA server to crash a c
Exploit-DB