CVE-2026-67855 Details
Description
open62541 contains a heap use-after-free in the GDS PushManagement certificate update workflow when UA_ENABLE_GDS_PUSHMANAGEMENT is enabled. This allows a remote attacker to cause a denial of service.
A heap use-after-free vulnerability has been identified in open62541 when the GDS PushManagement feature is enabled. This vulnerability arises during the certificate update process, specifically when the 'UpdateCertificate' method is followed by two 'ApplyChanges' calls within the same OPC UA 'CallRequest'. The issue allows a remote attacker to cause a denial-of-service by triggering a process crash via the 'secureChannel_delayedClose' function, which is part of the GDS transaction handling. The vulnerability is rooted in the GDS transaction management, where the same delayed callback node can be enqueued multiple times, leading to memory corruption and the use of freed memory.
Users can avoid this vulnerability by not using the GDS PushManagement feature until a patch is available. The vulnerability has been fixed in the open62541 repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 4, 2026CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/open62541/open62541/issues/8093 | CISA-ADP | ExploitIssue TrackingTechnical AnalysisVendor |
| https://github.com/open62541/open62541 | [email protected] | Vendor |
| https://github.com/open62541/open62541/blob/master/arch/posix/eventloop_posix.c | [email protected] | Source CodeVendor |
| https://github.com/open62541/open62541/blob/master/examples/encryption/server_encryption.c | [email protected] | Source CodeVendor |
| https://github.com/open62541/open62541/blob/master/src/server/ua_server_internal.h | [email protected] | Source CodeVendor |
| https://github.com/open62541/open62541/blob/master/src/server/ua_server_ns0_gds.c | [email protected] | Broken LinkSource CodeVendor |
| https://github.com/open62541/open62541/issues/8093 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| open62541 | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 4, 2026 | New CVE Received | [email protected] |