CVE-2026-11946: CWE-770 Allocation of resources without limits or throttling in open62541 project / o6 Automation GmbH open62541
An unauthenticated remote attacker can exhaust server memory via the GetEndpoints Discovery Service in open62541. The endpointUrl field of GetEndpointsRequest is not validated for length. An attacker can declare an arbitrarily large string (up to ~4.09 GB via the UInt32 length field) delivered across intermediate chunks without ever sending the final chunk. The server buffers all chunks in RAM indefinitely until the SecureChannel times out. The attack is pre-session and bypasses all encryption configurations. The issue affects open62541: from 1.4.0 through 1.4.16, from 1.5.0 through 1.5.4, master.
AI Analysis
Technical Summary
The vulnerability in open62541 arises from lack of validation on the length of the endpointUrl field in GetEndpointsRequest. An attacker can send a very large string (up to approximately 4.09 GB) in multiple chunks without completing the transmission. The server buffers these chunks in RAM indefinitely, exhausting memory resources until the SecureChannel times out. This is a pre-authentication denial of service vulnerability that bypasses encryption configurations. Affected versions include 1.4.0 through 1.4.16, 1.5.0 through 1.5.4, and the master branch. No official patch or remediation level has been published yet.
Potential Impact
The vulnerability allows unauthenticated remote attackers to cause a denial of service by exhausting server memory resources. This can disrupt availability of the open62541 server by consuming RAM indefinitely during the GetEndpoints Discovery Service request processing. There is no impact on confidentiality or integrity reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider limiting exposure of the GetEndpoints service to untrusted networks or implementing network-level protections to detect and block unusually large or incomplete GetEndpointsRequest messages. Monitor for updates from the open62541 project regarding official patches or mitigations.
CVE-2026-11946: CWE-770 Allocation of resources without limits or throttling in open62541 project / o6 Automation GmbH open62541
Description
An unauthenticated remote attacker can exhaust server memory via the GetEndpoints Discovery Service in open62541. The endpointUrl field of GetEndpointsRequest is not validated for length. An attacker can declare an arbitrarily large string (up to ~4.09 GB via the UInt32 length field) delivered across intermediate chunks without ever sending the final chunk. The server buffers all chunks in RAM indefinitely until the SecureChannel times out. The attack is pre-session and bypasses all encryption configurations. The issue affects open62541: from 1.4.0 through 1.4.16, from 1.5.0 through 1.5.4, master.
CVSS v3.1
Score 7.5high
Affected software
pkg:github/open62541/open62541Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in open62541 arises from lack of validation on the length of the endpointUrl field in GetEndpointsRequest. An attacker can send a very large string (up to approximately 4.09 GB) in multiple chunks without completing the transmission. The server buffers these chunks in RAM indefinitely, exhausting memory resources until the SecureChannel times out. This is a pre-authentication denial of service vulnerability that bypasses encryption configurations. Affected versions include 1.4.0 through 1.4.16, 1.5.0 through 1.5.4, and the master branch. No official patch or remediation level has been published yet.
Potential Impact
The vulnerability allows unauthenticated remote attackers to cause a denial of service by exhausting server memory resources. This can disrupt availability of the open62541 server by consuming RAM indefinitely during the GetEndpoints Discovery Service request processing. There is no impact on confidentiality or integrity reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider limiting exposure of the GetEndpoints service to untrusted networks or implementing network-level protections to detect and block unusually large or incomplete GetEndpointsRequest messages. Monitor for updates from the open62541 project regarding official patches or mitigations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- ENISA
- Date Reserved
- 2026-06-10T21:38:14.592Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a464d5727e9c79719ca1ec9
Added to database: 07/02/2026, 11:36:55 UTC
Last enriched: 07/02/2026, 12:37:16 UTC
Last updated: 07/02/2026, 23:28:57 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.