CVE-2026-33592— FindServers Memory Exhaustion in open62541
Possible ATT&CK Techniques 1AI
T1496 · Resource HijackingAffected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| open62541 project / o6 Automation GmbH | open62541 | 1.4.0≤ 1.4.16 | affected |
1.5.0≤ 1.5.4 | affected | ||
master | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-33592
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
FindServers Memory Exhaustion in open62541
Source: NVD (National Vulnerability Database)
Vulnerability Description
An unauthenticated remote attacker can exhaust server memory via the FindServers Discovery Service in open62541. The serverUris field of FindServersRequest is not validated for length or array size. An attacker can declare an arbitrarily large string (up to ~3.9 GB) delivered across intermediate chunks without ever sending the final chunk. The server buffers all chunks in RAM indefinitely until the SecureChannel times out. The attack is pre-session and bypasses all encryption configuration. The issue affects open62541: from 1.4.0 through 1.4.16, from 1.5.0 through 1.5.4, master.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
不加限制或调节的资源分配
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| open62541 project / o6 Automation GmbH | open62541 | 1.4.0 ~ 1.4.16 | - |
II. Public POCs for CVE-2026-33592
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-33592
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-33592 (2)
IV. Related Vulnerabilities
Same weakness: CWE-770
- CVE-2026-58465
Eclipse Wakaama CoAP Block1 Handler Unbounded Memory Allocat - CVE-2026-11946
GetEndpoints Memory Exhaustion in open62541 - CVE-2026-54428
Apache HttpComponents Core: HPackDecoder Unlimited Header Li - CVE-2026-49087
Allocation of Resources Without Limits or Throttling in Kiba - CVE-2026-20216
ClamAV InstallShield File Format Processing Resource Exhaust
V. Comments for CVE-2026-33592
No comments yet