In open62541 v1.5.5, the AddReferences server-side function contains an incomplete validation flaw related to non-local ExpandedNodeId targets. Specifically, if an attacker sends an AddReferencesRequest with an empty targetServerUri and a non-zero targetNodeId.serverIndex, the target node pointer remains NULL while the server continues execution. This can lead to a NULL pointer dereference, classified under CWE-476, potentially resulting in a crash or denial of service. The vulnerability has a CVSS 3.1 base score of 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

The vulnerability allows remote attackers to cause a NULL pointer dereference on the server by sending a specially crafted AddReferencesRequest. This can lead to denial of service or potentially other impacts depending on server behavior when dereferencing NULL pointers. The high CVSS score reflects the critical nature and ease of exploitation without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Users of open62541 v1.5.5 should monitor vendor communications for updates and consider restricting access to the affected service until a fix is available.