CVE-2026-67861 Details
Description
An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via the UA_Client_getRemoteDataTypes component
A denial-of-service vulnerability has been identified in open62541 versions through 1.5.5. The issue arises in the UA_Client_getRemoteDataTypes function, where the client recursively traverses the remote DataType graph without any limits. This unbounded recursion can be exploited by a malicious OPC UA server, leading to stack exhaustion and a crash. The vulnerability is triggered during normal protocol interactions, after establishing a secure session with the server.
The vulnerability can be addressed by modifying the open62541 client library to replace the recursive depth-first search with an iterative traversal that includes strict limits on the number of nodes processed and the depth of the traversal. This change should be implemented in the ua_client_util.c file, specifically within the browseDataTypesRecursive function, which currently lacks any safeguards against excessive recursion.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | CISA-ADP |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 4, 2026 | New CVE Received | [email protected] |