The open62541 project is affected by a resource exhaustion vulnerability (CWE-770) due to improper validation of the serverUris field in the FindServers Discovery Service request. An unauthenticated attacker can send a very large string (up to approximately 3.9 GB) in multiple chunks without completing the final chunk. The server buffers these chunks in memory indefinitely until the SecureChannel times out, leading to potential denial of service via memory exhaustion. This vulnerability affects versions from 1.4.0 through 1.4.16, 1.5.0 through 1.5.4, and the master branch. The attack is pre-session and bypasses encryption, requiring no privileges or user interaction. No official patch or remediation level has been published as of the data provided.

The vulnerability allows an unauthenticated remote attacker to cause a denial of service by exhausting server memory resources. This can disrupt the availability of the open62541 server by causing it to consume excessive RAM, potentially leading to crashes or degraded performance. There is no impact on confidentiality or integrity reported. The attack bypasses encryption and session establishment, making it easier to exploit remotely.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing network-level protections such as rate limiting or filtering to restrict access to the FindServers Discovery Service. Monitor for unusual traffic patterns that may indicate exploitation attempts. Avoid exposing the service to untrusted networks where possible.