# CVE-2026-11946: open62541 memory exhaustion in GetEndpoints Discovery Service

Source: https://junglewise.ai/threats/cve-2026-11946-open62541-memory-exhaustion-in-getendpoints-discovery-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-02. Updated: 2026-07-02  
License: CC BY 4.0 with a link back

CVE-2026-11946 · Severity: high · CVSS 7.5 · Published 2026-07-02

A vulnerability in the open62541 library, which is used for industrial communication (OPC UA), allows an unauthenticated attacker to crash the server by exhausting its memory. By sending specially crafted requests that the server stores indefinitely, an attacker can cause a complete service outage. This attack can be performed remotely and bypasses standard security and encryption settings.

Technologies: [Open62541 Project Open62541](https://junglewise.ai/threats/technologies/open62541). Vendors: [Open62541 Project](https://junglewise.ai/threats/vendors/open62541-project).

## Quick answers

**Is CVE-2026-11946 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11946 being exploited in the wild.

**How severe is CVE-2026-11946?** High severity, with a CVSS score of 7.5, published 2 July 2026.

**Which products and versions are affected?** Open62541 Project Open62541 1.4.0 through 1.4.16, 1.5.0 through 1.5.4, master branch.

**Is there a fix for CVE-2026-11946?** A patch was published on 2026-06-23: Fix merged into 1.4 branch via Pull Request 8142 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-11946 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-11946?** Check whether you run Open62541 Project Open62541 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A denial-of-service vulnerability exists in open62541 due to improper resource management in the GetEndpoints Discovery Service. The 'endpointUrl' field of a GetEndpointsRequest lacks length validation, allowing an attacker to declare a string size up to ~4.09 GB via a UInt32 length field. By delivering data across intermediate chunks without sending a final chunk, the attacker forces the server to buffer all data in RAM indefinitely until the SecureChannel times out. This pre-session attack bypasses encryption configurations and affects versions 1.4.x, 1.5.x, and the master branch. A fix has been merged to enforce default message and chunk size limits.

## Affected products

- open62541 project / o6 Automation GmbH open62541 1.4.0 through 1.4.16, 1.5.0 through 1.5.4, master branch

## Timeline

- 2026-06-23: patched: Fix merged into 1.4 branch via Pull Request 8142
- 2026-07-02: advisory: NVD publication date

## References

- [https://github.com/open62541/open62541](https://github.com/open62541/open62541)
- [https://github.com/open62541/open62541/pull/8142](https://github.com/open62541/open62541/pull/8142)
- [https://github.com/open62541/open62541/pull/8142/changes/d253818d6c5e870e1db0e360b18138c8bdc809ae](https://github.com/open62541/open62541/pull/8142/changes/d253818d6c5e870e1db0e360b18138c8bdc809ae)

## Related threats

- [open62541 memory exhaustion in FindServers Discovery Service](https://junglewise.ai/threats/cve-2026-33592-open62541-memory-exhaustion-in-findservers-discovery-service)