An unauthenticated remote attacker can exploit a resource exhaustion vulnerability in open62541's FindServers Discovery Service by sending an excessively large serverUris field in the FindServersRequest message. The server does not impose limits on the length or array size of this field and buffers incoming chunks in memory indefinitely until the SecureChannel times out. This leads to server memory exhaustion and potential denial of service. The vulnerability affects open62541 versions 1.4.0 through 1.4.16 and 1.5.0 through 1.5.4, as well as the master branch. The attack is pre-session and bypasses encryption, requiring no privileges or user interaction.

The vulnerability allows an unauthenticated attacker to cause a denial of service by exhausting server memory resources, potentially leading to server crashes or degraded performance. There is no impact on confidentiality or integrity as per the CVSS vector. The attack bypasses encryption and authentication mechanisms because it occurs before session establishment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, consider limiting exposure of the FindServers Discovery Service to untrusted networks or implementing network-level protections to detect and block abnormal large or incomplete requests targeting this service.