Skip to main content

Eclipse Milo EUVDEUVD-2026-52659

| CVE-2026-61387 MEDIUM
Improper Cleanup on Thrown Exception (CWE-460)
2026-08-04 eclipse GHSA-54cr-fx8f-gpc5
Buffer Overflow Eclipse Milo
6.9
CVSS 4.0 · Vendor: eclipse
Share

Severity by source

Vendor (eclipse) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.3 MEDIUM

Network-reachable unauthenticated attack with no complexity; impact is limited availability only (partial DoS, no confidentiality or integrity loss, scope unchanged).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (eclipse).

CVSS VectorVendor: eclipse

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Aug 04, 2026 - 13:16 EUVD
Source Code Evidence Fetched
Aug 04, 2026 - 13:09 vuln.today
Analysis Generated
Aug 04, 2026 - 13:09 vuln.today

DescriptionCVE.org

In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server-global reservation is not restored. Deeply nested PubSub ExtensionObjects in a CreateMonitoredItems event filter can trigger a StackOverflowError during decoding, allowing an unauthenticated remote client to exhaust a finite global monitored-item quota and prevent all clients from creating new monitored items until restart. Existing monitored items and other server functions remain unaffected.

AnalysisAI

Unauthenticated remote clients can permanently exhaust the global monitored-item quota in Eclipse Milo OPC UA SDK versions 1.0.0 through 1.1.4, effectively preventing all clients from creating new monitored items until the server is restarted. The attack combines two defects: the server's ExtensionObject decoder lacks recursion-depth enforcement, enabling deeply nested PubSub structures in a CreateMonitoredItems event filter to trigger a JVM StackOverflowError, and the quota accounting code is not exception-safe against unchecked JVM Errors, so the reserved slot is never reclaimed. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Connect to OPC UA endpoint (port 4840)
Delivery
Craft CreateMonitoredItems with deeply nested PubSub ExtensionObjects
Exploit
Decoding triggers JVM StackOverflowError
Execution
Exception-unsafe quota code leaks one reservation per request
Persist
Repeat until global quota exhausted
Impact
All clients denied new monitored-item creation
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The server must run Eclipse Milo versions 1.0.0 through 1.1.4 and its OPC UA endpoint must be network-reachable by the attacker. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 6.9 (Medium) with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N accurately models the risk envelope. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with TCP connectivity to the OPC UA endpoint (port 4840) sends a CreateMonitoredItems service request containing a PubSub event filter with hundreds of recursively nested ExtensionObjects, sufficient to overflow the JVM call stack during decoding. Because the StackOverflowError escapes the exception-safe quota cleanup, each such request permanently consumes one quota slot. …
Remediation Upgrade Eclipse Milo by incorporating the two upstream fix commits: 587e35669f519b2d7f6d850a5f86ee5a76c3a2c5 (recursion-depth guard in ExtensionObject) and 5f3f6da2a5ea80682e1da7c58f7a1870b09d2b43 (exception-safe quota accounting), available at https://github.com/eclipse-milo/milo/commit/587e35669f519b2d7f6d850a5f86ee5a76c3a2c5 and https://github.com/eclipse-milo/milo/commit/5f3f6da2a5ea80682e1da7c58f7a1870b09d2b43. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Eclipse Milo

View all
CVE-2026-60007 CRITICAL
9.1 Aug 04

Password recovery in Eclipse Milo (the open-source OPC UA SDK for Java) versions 0.6.0 through 1.1.4 allows an on-path a
CVE-2026-58080 HIGH
8.8 Aug 04

Silent authorization bypass in Eclipse Milo OPC UA server SDK versions 1.0.0-1.1.4 allows anonymous network clients to i
CVE-2026-63252 HIGH
8.7 Aug 04

Unauthenticated remote denial-of-service in Eclipse Milo 0.6.0-1.1.4 allows any network-accessible client to exhaust the
CVE-2026-62927 HIGH
8.7 Aug 04

Authorization bypass in Eclipse Milo's OPC UA Call service (versions 1.0.0-1.1.4) permits unauthenticated or low-privile
CVE-2026-63248 MEDIUM
6.9 Aug 04

Session security diagnostics nodes in Eclipse Milo 0.6.0 through 1.1.4 expose sensitive OPC UA session metadata without

Same weakness CWE-460 – Improper Cleanup on Thrown Exception

View all
CVE-2023-46393 HIGH POC
7.5
CVE-2025-69652 MEDIUM POC
6.2
CVE-2026-40583 HIGH
8.8
CVE-2024-0316 HIGH
7.5
CVE-2024-20354 HIGH
7.4
CVE-2021-34716 HIGH
7.2
CVE-2026-20118 MEDIUM
6.8
CVE-2025-32439 MEDIUM
6.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2017-11882 HIGH POC
7.8

Share

EUVD-2026-52659 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy