CVE-2026-67856 in open62541
Summary
by MITRE • 08/05/2026
An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via crafted CreateSubscription, CreateMonitoredItems(Sampling), Publish, TransferSubscriptions, and DeleteSubscriptions requests
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
The vulnerability in open62541 versions 1.5.5 and earlier represents a critical denial of service flaw that can be exploited remotely through carefully crafted OPC UA protocol requests. This issue affects the industrial automation and IoT communication framework that is widely deployed in manufacturing environments, smart grid systems, and industrial control networks where open62541 serves as an open-source implementation of the OPC Unified Architecture standard. The vulnerability specifically targets the subscription management functionality within the OPC UA protocol stack, which is fundamental for real-time data monitoring and event notification in industrial systems.
The technical flaw manifests when the server processes maliciously constructed CreateSubscription requests that establish abnormal subscription states or when crafted CreateMonitoredItems requests with invalid sampling parameters are submitted to the server. Additionally, the vulnerability can be triggered through malformed Publish, TransferSubscriptions, and DeleteSubscriptions requests that exploit improper input validation and state management within the open62541 implementation. These requests bypass normal protocol validation mechanisms and cause the server to enter an inconsistent state or consume excessive computational resources during processing.
The operational impact of this vulnerability extends beyond simple service disruption as it can compromise the integrity of industrial control systems that depend on continuous OPC UA communication for process monitoring and automation. Attackers can exploit this weakness to repeatedly send malformed requests causing the server to crash, restart continuously, or become unresponsive, effectively rendering critical industrial processes unable to receive real-time data updates or execute automated responses. This vulnerability directly relates to CWE-400 which addresses "Uncontrolled Resource Consumption" and aligns with ATT&CK technique T1499.004 for "Endpoint Denial of Service" within the context of industrial control systems.
Organizations using open62541 in production environments should immediately implement mitigations including updating to version 1.5.6 or later where this vulnerability has been addressed through enhanced input validation and proper resource management. Network segmentation and access controls should be implemented to limit exposure of OPC UA servers to untrusted networks while monitoring for anomalous request patterns that may indicate exploitation attempts. The fix typically involves strengthening parameter validation in subscription management functions, implementing robust error handling for malformed requests, and adding rate limiting mechanisms to prevent abuse of the vulnerable operations. System administrators should also consider implementing intrusion detection systems specifically configured to detect OPC UA protocol anomalies and maintain regular security assessments of industrial control network infrastructure to identify similar vulnerabilities in other protocol implementations.