FindServers Memory Exhaustion in open62541

published 2026-07-02 4 mo ago modified 2026-10-25 14 d ago also EUVD-2026-41256

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 44%
public exploits: 0; none known

An unauthenticated remote attacker can exhaust server memory via the FindServers Discovery Service in open62541. The serverUris field of FindServersRequest is not validated for length or array size. An attacker can declare an arbitrarily large string (up to ~3.9 GB) delivered across intermediate chunks without ever sending the final chunk. The server buffers all chunks in RAM indefinitely until the SecureChannel times out. The attack is pre-session and bypasses all encryption configuration. The issue affects open62541: from 1.4.0 through 1.4.16, from 1.5.0 through 1.5.4, master.

Patch / fix

links 2

github.com/open62541/open62541#8142 pull request
github.com/open62541/open62541#8142 pull request

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-33592 updated 2026-07-02 cvss 7.5

open62541: open62541: Remote attacker can cause Denial of Service via FindServers Discovery Service

Red Hat All currently supported Red Hat products
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 4 mo ago (2026-07-02)

Exploit prediction

0.52% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

open62541 project / o6 Automation GmbH open62541

Classification

Weakness

CWE-770 Allocation of Resources Without Limits or Throttling
CWE-789 Memory Allocation with Excessive Size Value

References

Sources

CVE List CVE-2026-33592
NVD CVE-2026-33592

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary