GetEndpoints Memory Exhaustion in open62541

published 2026-07-02 4 mo ago modified 2026-10-25 14 d ago also EUVD-2026-41326

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 44%
public exploits: 0; none known

An unauthenticated remote attacker can exhaust server memory via the GetEndpoints Discovery Service in open62541. The endpointUrl field of GetEndpointsRequest is not validated for length. An attacker can declare an arbitrarily large string (up to ~4.09 GB via the UInt32 length field) delivered across intermediate chunks without ever sending the final chunk. The server buffers all chunks in RAM indefinitely until the SecureChannel times out. The attack is pre-session and bypasses all encryption configurations.

The issue affects open62541: from 1.4.0 through 1.4.16, from 1.5.0 through 1.5.4, master.

Patch / fix

links 2

github.com/open62541/open62541#8142 pull request
github.com/open62541/open62541#8142 pull request

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-11946 updated 2026-07-02 cvss 7.5

open62541: open62541: Denial of Service via unvalidated endpoint URL length

Red Hat All currently supported Red Hat products
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 4 mo ago (2026-07-02)

Exploit prediction

0.52% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

open62541 project / o6 Automation GmbH open62541

Classification

Weakness

CWE-770 Allocation of Resources Without Limits or Throttling
CWE-789 Memory Allocation with Excessive Size Value

References

Sources

CVE List CVE-2026-11946
NVD CVE-2026-11946

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary