CVE-2026-33592 Details
Description
An unauthenticated remote attacker can exhaust server memory via the FindServers Discovery Service in open62541. The serverUris field of FindServersRequest is not validated for length or array size. An attacker can declare an arbitrarily large string (up to ~3.9 GB) delivered across intermediate chunks without ever sending the final chunk. The server buffers all chunks in RAM indefinitely until the SecureChannel times out. The attack is pre-session and bypasses all encryption configuration. The issue affects open62541: from 1.4.0 through 1.4.16, from 1.5.0 through 1.5.4, master.
A denial-of-service vulnerability has been identified in open62541 versions 1.4.0 prior to 1.4.16, 1.5.0 prior to 1.5.4, and in the master branch. The issue arises in the FindServers Discovery Service, where the serverUris field of the FindServersRequest is not properly validated for length or array size. This allows an unauthenticated remote attacker to send an arbitrarily large string, delivered in chunks, without sending the final chunk. The server buffers these chunks in memory indefinitely, causing memory exhaustion until the SecureChannel times out. This vulnerability is pre-session and bypasses all encryption configurations.
Users can update to open62541 versions 1.4.16 or 1.5.4, where this vulnerability has been addressed. Instructions for downloading open62541 can be found in the project's documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | ENISA |
| CWE-789 | Memory Allocation with Excessive Size Value | ENISA |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 2, 2026 | CVE Modified | CISA-ADP |
| Jul 2, 2026 | New CVE Received | ENISA |