CVE-2026-67859 Details
Description
Buffer Overflow vulnerability in open62541 v1.5.5 allows a remote attacker to cause a denial of service via the Discovery/LDS handling.
A buffer overflow vulnerability has been identified in open62541 version 1.5.5. This vulnerability allows a remote attacker to cause a denial-of-service by exploiting the Discovery/Local Discovery Server (LDS) handling. The issue arises because the length of the 'discoveryUrl.path' in the 'RegisterServer' request is not properly validated before being used to allocate memory on the stack. This oversight can lead to stack exhaustion and a crash of the server process.
A patch has been suggested that involves capping the maximum allowed length of the 'discoveryUrl.path' before it is used to create a stack-based array. This cap should be set to a conservative value, such as 1024 bytes. Additionally, the patch should include a check to reject any 'discoveryUrl' values that exceed this length.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-120 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') | CISA-ADP |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 4, 2026 | New CVE Received | [email protected] |