Eclipse Milo EUVD-2026-52662

Eclipse Milo (cpe:2.3:a:eclipse_foundation:eclipse_milo) is the primary open-source Java implementation of OPC UA (OPC Unified Architecture), a publish-subscribe and request-response communication protocol standard for industrial automation, SCADA, and IoT systems. OPC UA messages are transported in fragments called chunks; the server accumulates these in memory until a complete message is assembled. The UASC (UA Secure Conversation) layer handles session establishment and security handshakes before authentication. The vulnerable components are UascServerAsymmetricHandler - which manages the OpenSecureChannel handshake - and ChunkDecoder, both of which used a raw List<ByteBuf> to accumulate partial chunks. Netty ByteBuf objects are reference-counted off-heap (direct) memory allocations; failure to call safeRelease() or releaseAll() when the channel becomes inactive or the handler is removed constitutes CWE-401 (Missing Release of Memory after Effective Lifetime). The fix introduces a dedicated ChunkBufferAccumulator class with a releaseAll() method wired into channelInactive() and the new handlerRemoved0() override, and wraps ChunkDecoder decode paths in finally blocks to ensure release on decode failure or exception.