Is there a patch available for CVE-2026-61387?

Yes, a patch is available for CVE-2026-61387. Update the affected software to the latest version immediately.

Eclipse Milo CVE-2026-61387

Q: What is the CVSS score of CVE-2026-61387?

CVE-2026-61387 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-52659 MEDIUM

Improper Cleanup on Thrown Exception (CWE-460)

2026-08-04 eclipse

GHSA-54cr-fx8f-gpc5

Buffer Overflow Eclipse Milo Eclipse Foundation

6.9

CVSS 4.0 · Vendor: eclipse

Severity by source

Vendor (eclipse) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Network-reachable unauthenticated attack with no complexity; impact is limited availability only (partial DoS, no confidentiality or integrity loss, scope unchanged).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (eclipse).

CVSS VectorVendor: eclipse

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 04, 2026 - 13:16 EUVD

Source Code Evidence Fetched

Aug 04, 2026 - 13:09 vuln.today

Analysis Generated

Aug 04, 2026 - 13:09 vuln.today

DescriptionCVE.org

In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server-global reservation is not restored. Deeply nested PubSub ExtensionObjects in a CreateMonitoredItems event filter can trigger a StackOverflowError during decoding, allowing an unauthenticated remote client to exhaust a finite global monitored-item quota and prevent all clients from creating new monitored items until restart. Existing monitored items and other server functions remain unaffected.

AnalysisAI

Unauthenticated remote clients can permanently exhaust the global monitored-item quota in Eclipse Milo OPC UA SDK versions 1.0.0 through 1.1.4, effectively preventing all clients from creating new monitored items until the server is restarted. The attack combines two defects: the server's ExtensionObject decoder lacks recursion-depth enforcement, enabling deeply nested PubSub structures in a CreateMonitoredItems event filter to trigger a JVM StackOverflowError, and the quota accounting code is not exception-safe against unchecked JVM Errors, so the reserved slot is never reclaimed. No public exploit code has been identified and this CVE is absent from the CISA KEV catalog; however, the CVSS 4.0 vector AV:N/AC:L/PR:N/UI:N confirms the attack is network-reachable with no authentication or complexity barriers.

Technical ContextAI

Eclipse Milo is an open-source OPC UA (IEC 62541) SDK for Java maintained by the Eclipse Foundation, used in industrial automation, SCADA, and IIoT deployments. The vulnerability arises from two interacting defects in the opc-ua-stack module. First, the ExtensionObject.decode() method in org.eclipse.milo.opcua.stack.core.types.builtin.ExtensionObject had no recursion-depth guard: arbitrarily nested ExtensionObjects supplied in PubSub event filters would recurse through the Java call stack until a StackOverflowError was thrown - a subclass of java.lang.Error, not Exception. Second, the server's monitored-item quota accounting code did not handle unchecked Errors in its cleanup path (CWE-460: Improper Cleanup on Thrown Exception), so the StackOverflowError escaped without restoring the reserved quota slot. The upstream fix (commit 587e3566) introduces a ThreadLocal integer depth counter in ExtensionObject, checked against context.getEncodingLimits().getMaxRecursionDepth() before each decode call, converting uncontrolled recursion into a catchable UaSerializationException with status Bad_EncodingLimitsExceeded. A companion commit (5f3f6da2) addresses the exception-safe quota restoration. The CPE cpe:2.3:a:eclipse_foundation:eclipse_milo:*:*:*:*:*:*:*:* covers all versions; the stated range is 1.0.0 through 1.1.4.

RemediationAI

Upgrade Eclipse Milo by incorporating the two upstream fix commits: 587e35669f519b2d7f6d850a5f86ee5a76c3a2c5 (recursion-depth guard in ExtensionObject) and 5f3f6da2a5ea80682e1da7c58f7a1870b09d2b43 (exception-safe quota accounting), available at https://github.com/eclipse-milo/milo/commit/587e35669f519b2d7f6d850a5f86ee5a76c3a2c5 and https://github.com/eclipse-milo/milo/commit/5f3f6da2a5ea80682e1da7c58f7a1870b09d2b43. The first tagged release version incorporating these fixes is not confirmed in the available data - consult the Eclipse Milo GitHub releases page and the advisory at https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/598 to identify the patched release before upgrading. As a compensating control prior to patching, restrict network access to the OPC UA endpoint (default TCP port 4840) to known, trusted client hosts using firewall rules or network segmentation; this reduces exposure but does not eliminate risk from compromised trusted hosts. If the deployed version exposes a configurable EncodingLimits.maxRecursionDepth parameter, setting a low value (e.g., 4-8) limits the stack depth achievable during decoding and may prevent StackOverflowError, though this is not a full fix for the non-exception-safe quota accounting. Note that quota recovery after exploitation requires a server restart.