Lorenzo Cannella

**Name of the Vulnerable Software and Affected Versions** open62541 versions 1.4.0 through 1.4.16 open62541 versions 1.5.0 through 1.5.4 open62541 master **Description** An unauthenticated remote attacker can cause server memory exhaustion through the FindServers Discovery Service. The issue occurs because the `serverUris` field of the `FindServersRequest` is not validated for length or array size. An attacker can declare an arbitrarily large string, up to approximately 3.9 GB, delivered in intermediate chunks without sending the final chunk. The server buffers these chunks in RAM indefinitely until the SecureChannel times out. This attack occurs pre-session and bypasses all encryption configurations. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** open62541 versions 1.4.0 through 1.4.16 open62541 versions 1.5.0 through 1.5.4 open62541 master **Description** An unauthenticated remote attacker can cause server memory exhaustion through the GetEndpoints Discovery Service. The `endpointUrl` field of the GetEndpointsRequest is not validated for length, allowing an attacker to declare an arbitrarily large string (up to approximately 4.09 GB via the `UInt32` length field). By delivering this string across intermediate chunks without sending the final chunk, the server buffers all data in RAM indefinitely until the SecureChannel times out. This attack occurs pre-session and bypasses all encryption configurations. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.