EUVD-2026-41256
GHSA-r94m-59fw-hm34
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated, pre-session, network-reachable trigger with low complexity gives AV:N/AC:L/PR:N/UI:N; impact is availability-only memory exhaustion, so C:N/I:N/A:H.
Primary rating from Vendor (ENISA).
CVSS VectorVendor: ENISA
Lifecycle Timeline
1DescriptionCVE.org
An unauthenticated remote attacker can exhaust server memory via the FindServers Discovery Service in open62541. The serverUris field of FindServersRequest is not validated for length or array size. An attacker can declare an arbitrarily large string (up to ~3.9 GB) delivered across intermediate chunks without ever sending the final chunk. The server buffers all chunks in RAM indefinitely until the SecureChannel times out. The attack is pre-session and bypasses all encryption configuration. The issue affects open62541: from 1.4.0 through 1.4.16, from 1.5.0 through 1.5.4, master.
AnalysisAI
Remote memory exhaustion in open62541's FindServers Discovery Service lets an unauthenticated attacker crash or degrade OPC UA servers built on versions 1.4.0-1.4.16, 1.5.0-1.5.4, and master. Because the serverUris field of a FindServersRequest is never validated for length or array size, an attacker can declare a string of up to ~3.9 GB and stream it across chunks while withholding the final chunk, forcing the server to buffer everything in RAM until the SecureChannel times out. The attack is pre-session, requires no authentication, and bypasses all encryption configuration; no public exploit identified at time of analysis.
Technical ContextAI
open62541 is a widely used open-source C implementation of the OPC UA (IEC 62541) industrial machine-to-machine communication protocol, common in OT/IIoT gateways, PLCs, SCADA components, and edge devices. The flaw sits in the Discovery layer's FindServers service, which is reachable before a session (and before security handshakes) are established. OPC UA messages can be split into multiple chunks; here the server accepts an arbitrarily large declared string/array size in the serverUris field and accumulates incoming chunks in memory without bound. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): the decoder trusts the client-declared length, allowing a single connection to reserve/buffer memory far beyond any legitimate request until the SecureChannel timeout fires.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - apply the fix from https://github.com/open62541/open62541/pull/8142 (change https://github.com/open62541/open62541/pull/8142/changes/d253818d6c5e870e1db0e360b18138c8bdc809ae) by upgrading to a build that includes it once a tagged 1.4.x/1.5.x release ships, or by cherry-picking the patch into your current build. Because exploitation is pre-session and unauthenticated, the most effective compensating control is network segmentation: restrict access to the OPC UA Discovery port (default TCP 4840) to trusted management/OT hosts only via firewall or ACLs, which prevents arbitrary clients from reaching FindServers but also blocks legitimate remote discovery clients. Additionally, lower the SecureChannel timeout so buffered chunks are released sooner (reducing the memory-hold window at the cost of dropping slow legitimate clients), place the server behind an OPC UA-aware proxy/gateway that enforces message-size limits, and monitor server memory to alert on the sustained growth this attack produces.
Use-after-free in open62541 up to version 1.5.5 allows remote unauthenticated attackers to crash the OPC UA server's His
Uncontrolled memory consumption in open62541's OPC UA Discovery Service allows a remote, unauthenticated attacker to cra
The package open62541/open62541 before 1.2.5, from 1.3-rc1 and before 1.3.1 are vulnerable to Denial of Service (DoS) du
Heap-based buffer overflow in open62541 up to version 1.5.5 allows local low-privileged attackers to corrupt heap memory
Use-after-free memory corruption in open62541's example client code allows a local low-privileged user to cause memory c
Null pointer dereference in open62541's client library (versions up to 1.5.5) allows a remote OPC UA server to crash a c
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today