Vulnerability · Published Jul 5, 2024 · Assigned by mitre
CVE-2024-33862
High 7.5
In plain English
A high-severity resource allocation without limits in the opcfoundation.netstandard.opc.ua.core package (NuGet). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A buffer-management vulnerability in OPC Foundation OPCFoundation.NetStandard.Opc.Ua.Core before 1.05.374.54 could allow remote attackers to exhaust memory resources. It is triggered when the system receives an excessive number of messages from a remote source. This could potentially lead to a denial of service (DoS) condition, disrupting the normal operation of the system.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| NuGet | opcfoundation.netstandard.opc.ua.core | 1.5.374.54 | GHSA-4q2p-hwmr-qcxc |
Affected products (as reported)
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H