CVE-2026-11946

Name of the Vulnerable Software and Affected Versions open62541 versions 1.4.0 through 1.4.16 open62541 versions 1.5.0 through 1.5.4 open62541 master

Description An unauthenticated remote attacker can cause server memory exhaustion through the GetEndpoints Discovery Service. The endpointUrl field of the GetEndpointsRequest is not validated for length, allowing an attacker to declare an arbitrarily large string (up to approximately 4.09 GB via the UInt32 length field). By delivering this string across intermediate chunks without sending the final chunk, the server buffers all data in RAM indefinitely until the SecureChannel times out. This attack occurs pre-session and bypasses all encryption configurations.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.