Abhinav Agarwal

**Name of the Vulnerable Software and Affected Versions** Eclipse Milo versions 0.6.0 through 1.1.4 **Description** UASC server transport handlers do not release retained partial message chunks upon channel disconnection. This allows a remote unauthenticated client to exhaust pooled direct memory by repeatedly sending incomplete chunks and disconnecting, which may lead to server termination. **Recommendations** Update Eclipse Milo to a version later than 1.1.4.

**Name of the Vulnerable Software and Affected Versions** Eclipse Milo versions 1.0.0 through 1.1.4 **Description** The Call service dispatches the original mixed batch to address-space handlers after calculating authorization. This allows an anonymous or low-privileged client to execute a denied method by batching it with an allowed method. **Recommendations** Update Eclipse Milo to a version later than 1.1.4.

**Name of the Vulnerable Software and Affected Versions** Eclipse Milo versions 0.6.0 through 1.1.4 **Description** OPC UA server diagnostics nodes fail to enforce access authorization. This allows an anonymous client to enable diagnostics via a None/None endpoint without a certificate. Additionally, a client using a trusted application certificate over SignAndEncrypt can read security diagnostics for other active sessions, which exposes usernames, login history, authentication mechanisms, security modes, policies, and public client certificates. **Recommendations** Update Eclipse Milo to a version later than 1.1.4.

**Name of the Vulnerable Software and Affected Versions** Eclipse Milo versions 1.0.0 through 1.1.4 **Description** The `OpcUaServerConfig.copy()` function fails to preserve a configured `RoleMapper`. On servers that rely on role permissions and construct the running configuration using `copy()`, sessions are not assigned role IDs. Consequently, the default access controller bypasses role-permission checks. This allows anonymous clients, in environments where anonymous sessions are permitted, to read role-permission metadata, invoke protected methods, or delete protected nodes. **Recommendations** Update Eclipse Milo to a version later than 1.1.4. As a temporary mitigation, avoid using the `OpcUaServerConfig.copy()` function to construct the running configuration if the server relies on role permissions.

**Name of the Vulnerable Software and Affected Versions** Eclipse Milo versions 0.6.0 through 1.1.4 **Description** Username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures. This allows an on-path attacker who captures a victim's `Basic128Rsa15`-encrypted username token to use repeated unauthenticated `ActivateSession` requests as a padding oracle—a side-channel attack that reveals information about the plaintext by observing error responses—to recover the victim's password and authenticate with the recovered credentials. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Eclipse Milo versions 1.0.0 through 1.1.4 **Description** Monitored-item quota accounting is not exception-safe, meaning that if item creation fails due to an unchecked error, the server-global reservation is not restored. An unauthenticated remote client can trigger a `StackOverflowError` during decoding by using deeply nested PubSub ExtensionObjects in a `CreateMonitoredItems` event filter. This allows the attacker to exhaust the finite global monitored-item quota, preventing all clients from creating new monitored items until the server is restarted. Existing monitored items and other server functions are not affected. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** hostapd versions 2.11 through 2.11 **Description** A missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) Multi-Link Operation (MLO) association request processing allows an unauthenticated attacker within wireless range to send a crafted management frame containing a malformed Multi-Link Element or Per-STA Profile subelement. In the function `hostapd process ml assoc req()`, the `link id` field can be parsed as value 15, while the `links[]` storage only contains valid entries for IDs 0 through 14. This results in an out-of-bounds write and small memory corruption during association processing before the 4-way handshake, leading to a denial of service through process termination. The issue specifically affects systems built with `CONFIG IEEE80211BE` enabled. **Recommendations** Update to version 2.12.

**Name of the Vulnerable Software and Affected Versions** OpenSSL (affected versions not specified) **Description** A remote peer can cause unbounded memory allocation leading to a Denial of Service and abnormal termination of an application acting as a QUIC client or server. This occurs when a malicious peer floods the local QUIC stack with PATH CHALLENGE frames. The stack allocates a PATH RESPONSE frame for every received PATH CHALLENGE, but these frames are only freed once the remote peer acknowledges their reception, which a malicious actor will not do, resulting in heap memory exhaustion. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.