CVE Feed

    Dashboard / CVE / CVE-2026-11946

    CVE-2026-11946

    An unauthenticated remote attacker can exhaust server memory via the GetEndpoints Discovery Service in open62541. The endpointUrl field of GetEndpointsRequest is not validated for length. An attacker can declare an arbitrarily large string (up to ~4.09 GB via the UInt32 length field) delivered across intermediate chunks without ever sending the final chunk. The server buffers all chunks in RAM indefinitely until the SecureChannel times out. The attack is pre-session and bypasses all encryption configurations. The issue affects open62541: from 1.4.0 through 1.4.16, from 1.5.0 through 1.5.4, master.

    Published:Jul 2, 2026
    Last Modified:Jul 6, 2026
    EPS:Jul 2, 2026
    EPSS Score:0.00386
    CVSS Score:7.5

    Affected Products

    Vendor
    Open62541
    Product
    Open62541

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-82623 (CVSS 5.5) — A vulnerability was detected in open62541 up to 1.5.5. Affected by this vulnerability is the function UA_DataV…
    CVE-2026-67863 (CVSS 7.5) — In open62541 1.5.5, a server-side use-after-free exists in the local MonitoredItem callback path. The issue oc…
    CVE-2026-67870 (CVSS 9.8) — In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for n…
    CVE-2026-67869 (CVSS 7.5) — Buffer Overflow vulnerability in open62541 v1.5.5 allows a remote attacker to cause a denial of service via th…
    CVE-2026-67864 (CVSS 7.5) — An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via the NodeMan…
    CVE-2026-18785 (CVSS 1.9) — A vulnerability was determined in o6 open62541 ca356b088ada7dee824d1b4acd07c1ff07ce242b. Impacted is the funct…
    CVE-2026-18784 (CVSS 1.9) — A vulnerability was found in o6 open62541 up to 1.5.5. This issue affects the function UA_Client_readNodeClass…
    CVE-2026-67860 (CVSS 7.5) — open62541 1.5.5 contains a heap-based buffer overflow in the default HistoryRead path when the default history…
    CVE-2026-67862 (CVSS 7.5) — open62541 1.5.5 contains a buffer-overflow in the high-level attribute reading logic in src/client/ua_client_h…
    CVE-2026-67858 (CVSS 7.5) — Buffer Overflow vulnerability exists in open62541 1.5.5 when the Local Discovery Server (LDS) is built with mu…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High