CVE-2026-33592

Name of the Vulnerable Software and Affected Versions open62541 versions 1.4.0 through 1.4.16 open62541 versions 1.5.0 through 1.5.4 open62541 master

Description An unauthenticated remote attacker can cause server memory exhaustion through the FindServers Discovery Service. The issue occurs because the serverUris field of the FindServersRequest is not validated for length or array size. An attacker can declare an arbitrarily large string, up to approximately 3.9 GB, delivered in intermediate chunks without sending the final chunk. The server buffers these chunks in RAM indefinitely until the SecureChannel times out. This attack occurs pre-session and bypasses all encryption configurations.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.