Log in Start free

Vulnerability · Published Jul 2, 2026 · Assigned by ENISA

CVE-2026-11946GetEndpoints Memory Exhaustion in open62541

High 7.5

In plain English

A high-severity resource allocation without limits in open62541 from open62541 project / o6 Automation GmbH. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 55.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An unauthenticated remote attacker can exhaust server memory via the GetEndpoints Discovery Service in open62541. The endpointUrl field of GetEndpointsRequest is not validated for length. An attacker can declare an arbitrarily large string (up to ~4.09 GB via the UInt32 length field) delivered across intermediate chunks without ever sending the final chunk. The server buffers all chunks in RAM indefinitely until the SecureChannel times out. The attack is pre-session and bypasses all encryption configurations. The issue affects open62541: from 1.4.0 through 1.4.16, from 1.5.0 through 1.5.4, master.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13open62541no fix listedDEBIAN-CVE-2026-11946
Debian:14open62541no fix listedDEBIAN-CVE-2026-11946
Ubuntu:25.10open62541no fix listedUBUNTU-CVE-2026-11946
Ubuntu:26.04:LTSopen62541no fix listedUBUNTU-CVE-2026-11946
Ubuntu:26.10open62541no fix listedUBUNTU-CVE-2026-11946

Affected products (as reported)

VendorProductVersions
open62541 project / o6 Automation GmbH open62541 1.4.0 – through 1.4.161.5.0 – through 1.5.4master

Weakness: CWE-770, CWE-789 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References