o6 Automation open62541 up to 1.4.16/1.5.4 FindServers Discovery Service serverUris allocation of resources

Summaryinfo

A vulnerability was found in o6 Automation open62541 up to 1.4.16/1.5.4. It has been classified as problematic. This vulnerability affects unknown code of the component FindServers Discovery Service. Performing a manipulation of the argument serverUris results in allocation of resources. This vulnerability is reported as CVE-2026-33592. The attack is possible to be carried out remotely. No exploit exists. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability, which was classified as problematic, was found in o6 Automation open62541 up to 1.4.16/1.5.4. This affects an unknown code block of the component FindServers Discovery Service. The manipulation of the argument serverUris with an unknown input leads to a allocation of resources vulnerability. CWE is classifying the issue as CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. This is going to have an impact on availability. The summary by CVE is:

An unauthenticated remote attacker can exhaust server memory via the FindServers Discovery Service in open62541. The serverUris field of FindServersRequest is not validated for length or array size. An attacker can declare an arbitrarily large string (up to ~3.9 GB) delivered across intermediate chunks without ever sending the final chunk. The server buffers all chunks in RAM indefinitely until the SecureChannel times out. The attack is pre-session and bypasses all encryption configuration. The issue affects open62541: from 1.4.0 through 1.4.16, from 1.5.0 through 1.5.4, master.

The weakness was disclosed by Lorenzo Cannella. It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-33592 since 03/23/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-41256). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Automation Software

Vendor

• o6 Automation

Name

• open62541

Version

• 1.4.0
• 1.4.1
• 1.4.2
• 1.4.3
• 1.4.4
• 1.4.5
• 1.4.6
• 1.4.7
• 1.4.8
• 1.4.9
• 1.4.10
• 1.4.11
• 1.4.12
• 1.4.13
• 1.4.14
• 1.4.15
• 1.4.16
• 1.5.0
• 1.5.1
• 1.5.2
• 1.5.3
• 1.5.4

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion