CVE-2026-61387

Name of the Vulnerable Software and Affected Versions Eclipse Milo versions 1.0.0 through 1.1.4

Description Monitored-item quota accounting is not exception-safe, meaning that if item creation fails due to an unchecked error, the server-global reservation is not restored. An unauthenticated remote client can trigger a StackOverflowError during decoding by using deeply nested PubSub ExtensionObjects in a CreateMonitoredItems event filter. This allows the attacker to exhaust the finite global monitored-item quota, preventing all clients from creating new monitored items until the server is restarted. Existing monitored items and other server functions are not affected.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.