CVE-2026-67861 in open62541
Summary
by MITRE • 08/05/2026
An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via the UA_Client_getRemoteDataTypes component
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/05/2026
The vulnerability exists within the open62541 industrial communication library version 1.5.5 and earlier, where a remote attacker can exploit a flaw in the UA_Client_getRemoteDataTypes component to trigger a denial of service condition. This issue represents a critical security weakness that compromises system availability and operational continuity in industrial environments relying on OPC UA protocols for machine-to-machine communication.
The technical flaw manifests when the client component processes remote data type information from OPC UA servers, specifically during the data type retrieval phase. The vulnerability stems from insufficient input validation and memory handling within the UA_Client_getRemoteDataTypes function, which fails to properly validate incoming data structures or limit resource consumption during data type processing. This allows an attacker to craft malicious data type responses that cause the client application to consume excessive memory resources or enter an infinite loop state.
From an operational perspective this vulnerability poses significant risks to industrial control systems and supervisory control and data acquisition environments where open62541 is deployed. The denial of service condition can disrupt critical manufacturing processes, prevent system monitoring, and potentially lead to production downtime. The remote nature of the attack means that adversaries can exploit this weakness from outside the network perimeter without requiring physical access or elevated privileges.
The vulnerability aligns with CWE-400, which addresses "Uncontrolled Resource Consumption" and specifically relates to denial of service conditions caused by inadequate resource management in software components. This weakness enables attackers to exhaust system resources through crafted inputs that cause the application to consume excessive memory or processing power. The attack vector follows patterns consistent with ATT&CK technique T1499.004, which covers "Endpoint Denial of Service" through resource exhaustion attacks against networked systems.
Mitigation strategies should include immediate patching to versions 1.6.0 and later where this vulnerability has been addressed through improved input validation and memory management. Organizations should also implement network segmentation to limit access to OPC UA services, deploy intrusion detection systems to monitor for suspicious data type requests, and establish robust monitoring protocols to detect unusual resource consumption patterns. Additionally, implementing rate limiting and connection throttling mechanisms can help reduce the impact of potential exploitation attempts while maintaining operational functionality.