Executive brief
open62541 is a widely-used OPC UA client library used in industrial automation and control systems. A malicious OPC UA server can exploit an unbounded recursive traversal in the data type discovery function to exhaust the client's call stack, crashing the client application. This denial-of-service attack is triggered during normal protocol operations after a complete handshake and session setup, making it a practical risk for any system using this library to connect to untrusted servers.
Technical details
The vulnerability is a stack overflow caused by unbounded recursion in the `browseDataTypesRecursive()` helper function within `UA_Client_getRemoteDataTypes()`. When automatically discovering remote custom data types, the client recursively walks the OPC UA type hierarchy by following `HasSubtype` references without any depth limit, node budget, or iterative work queue. A malicious server can return a syntethic chain of previously unseen `DataType` subtypes in successive `Browse` responses, causing the client to recurse indefinitely. The only protection—a visited-node tree keyed by `NodeId`—fails to prevent this attack because the attacker can supply a fresh `NodeId` at each recursion level. The vulnerability is triggered through the official public API `UA_Client_getRemoteDataTypes()` with default parameters, as demonstrated by the vulnerable official example in `examples/custom_datatype/client_types_custom.c`. No patch is confirmed available.
Affected products
- open62541 open62541 1.5.5 and before
Timeline
- 2026-08-04: disclosed
- 2026-08-04: advisory