Skip to main content

Eclipse Milo CVE-2026-63252

| EUVDEUVD-2026-52662 HIGH
Memory Leak (CWE-401)
2026-08-04 eclipse GHSA-8mrr-fgjx-37mf
Information Disclosure Eclipse Milo
8.7
CVSS 4.0 · Vendor: eclipse
Share

Severity by source

Vendor (eclipse) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Network-reachable pre-authentication endpoint, no complexity or interaction; availability-only impact as server crashes; scope unchanged within the server process.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (eclipse).

CVSS VectorVendor: eclipse

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 04, 2026 - 13:06 vuln.today
Analysis Generated
Aug 04, 2026 - 13:06 vuln.today
CVE Published
Aug 04, 2026 - 12:03 cve.org
HIGH 8.7

DescriptionCVE.org

In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message chunks when a channel disconnects, allowing a remote unauthenticated client to exhaust pooled direct memory by repeatedly sending incomplete chunks and disconnecting, potentially terminating the server.

AnalysisAI

Unauthenticated remote denial-of-service in Eclipse Milo 0.6.0-1.1.4 allows any network-accessible client to exhaust the OPC UA server's off-heap direct memory pool by repeatedly sending incomplete UASC message chunks and disconnecting before message assembly completes. The UASC server-side asymmetric handler and ChunkDecoder fail to invoke ReferenceCountUtil.safeRelease() on retained Netty ByteBuf objects when the channel lifecycle ends, causing unbounded off-heap memory accumulation. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Enumerate OPC UA server on TCP 4840
Delivery
Connect as unauthenticated client
Exploit
Send partial UASC OpenSecureChannel chunk headers
Install
Disconnect before message completes
C2
Repeat in automated loop to accumulate leaked ByteBuf references
Execute
Exhaust JVM direct memory pool
Impact
Server process terminates with OOM
Sign in to reveal

Vulnerability AssessmentAI

Exploitation No special conditions are required for exploitation - the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote unauthenticated exploitation against any default Eclipse Milo server configuration exposing a UASC endpoint. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) accurately represents the threat profile: the attack is fully network-accessible, requires no credentials, involves no special timing or race conditions, and produces high availability impact through server termination. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with TCP connectivity to port 4840 scripted a loop using any OPC UA client library: connect, send a syntactically valid chunk header with a declared payload length larger than the data actually sent, then abruptly close the TCP connection. Each cycle leaves one or more unreleased Netty ByteBuf allocations in the server's off-heap direct memory pool. …
Remediation Upgrade Eclipse Milo to a version beyond 1.1.4 once an official patched release is published; the upstream fix is committed at https://github.com/eclipse-milo/milo/commit/459715793ec54b0f33367a14f94264500a0d872b, but a tagged released patched version has not been independently confirmed from the available data - monitor the Eclipse Milo GitHub releases page for the official fix version. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, conduct a complete inventory of all systems running Eclipse Milo versions 0.6.0 through 1.1.4, classify deployments by criticality, and notify system owners to implement heightened monitoring. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Eclipse Milo

View all
CVE-2026-60007 CRITICAL
9.1 Aug 04

Password recovery in Eclipse Milo (the open-source OPC UA SDK for Java) versions 0.6.0 through 1.1.4 allows an on-path a
CVE-2026-58080 HIGH
8.8 Aug 04

Silent authorization bypass in Eclipse Milo OPC UA server SDK versions 1.0.0-1.1.4 allows anonymous network clients to i
CVE-2026-62927 HIGH
8.7 Aug 04

Authorization bypass in Eclipse Milo's OPC UA Call service (versions 1.0.0-1.1.4) permits unauthenticated or low-privile
CVE-2026-61387 MEDIUM
6.9 Aug 04

Unauthenticated remote clients can permanently exhaust the global monitored-item quota in Eclipse Milo OPC UA SDK versio
CVE-2026-63248 MEDIUM
6.9 Aug 04

Session security diagnostics nodes in Eclipse Milo 0.6.0 through 1.1.4 expose sensitive OPC UA session metadata without

Same weakness CWE-401 – Memory Leak

View all
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1
CVE-2023-23145 HIGH POC
7.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-63252 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy