Executive brief
A vulnerability in the open62541 library, which is used for industrial communication (OPC UA), allows an unauthenticated attacker to crash the server by exhausting its memory. By sending specially crafted requests that the server stores indefinitely, an attacker can cause a complete service outage. This attack can be performed remotely and bypasses standard security and encryption settings.
Technical details
A denial-of-service vulnerability exists in open62541 due to improper resource management in the GetEndpoints Discovery Service. The 'endpointUrl' field of a GetEndpointsRequest lacks length validation, allowing an attacker to declare a string size up to ~4.09 GB via a UInt32 length field. By delivering data across intermediate chunks without sending a final chunk, the attacker forces the server to buffer all data in RAM indefinitely until the SecureChannel times out. This pre-session attack bypasses encryption configurations and affects versions 1.4.x, 1.5.x, and the master branch. A fix has been merged to enforce default message and chunk size limits.
Affected products
- open62541 project / o6 Automation GmbH open62541 1.4.0 through 1.4.16, 1.5.0 through 1.5.4, master branch
Timeline
- 2026-06-23: patched: Fix merged into 1.4 branch via Pull Request 8142
- 2026-07-02: advisory: NVD publication date