CVE-2026-11946: open62541 Memory Exhaustion via GetEndpoints Discovery Service

Technical summary

CVE-2026-11946 is a memory exhaustion vulnerability in open62541's GetEndpoints Discovery Service. The vulnerability stems from insufficient validation of the endpointUrl field in GetEndpointsRequest messages. An attacker exploits the OPC UA binary protocol's chunking mechanism by declaring an arbitrarily large string length (up to the UInt32 maximum of approximately 4.09 GB) in the message header while delivering only partial chunks. The server allocates and buffers memory for the declared message size but never receives the final chunk to complete or abandon the transmission. The incomplete message persists in memory until the SecureChannel timeout occurs—potentially minutes of sustained memory consumption per connection. Because this occurs at the pre-session stage of the OPC UA handshake, no authentication is required and encryption configuration is irrelevant. An attacker can open multiple concurrent connections to amplify the denial-of-service impact.

Business impact

Availability disruption is the primary business risk. Affected open62541 deployments used in industrial control systems, building automation, or enterprise OPC UA networks can be rendered unresponsive or crash when memory is exhausted. Industrial environments are particularly sensitive: a manufacturing facility, utility control system, or critical infrastructure relying on OPC UA for real-time monitoring could experience production halts or safety-critical failures if the OPC UA server becomes unavailable. Unlike vulnerabilities requiring authentication or complex exploitation chains, this attack is trivial to execute remotely without specialized tools, making it a realistic threat in any environment exposing an open62541 server to untrusted networks.

Affected systems

open62541 versions 1.4.0 through 1.4.16, versions 1.5.0 through 1.5.4, and the master development branch are affected. open62541 is commonly embedded in industrial devices, building management systems, and enterprise software that implements the OPC UA (Open Platform Communications Unified Architecture) standard. Any organization running vulnerable versions—whether as a standalone server or as part of a larger product—should treat this as a critical inventory gap requiring immediate attention.

Exploitability

This vulnerability is highly exploitable with minimal barriers to attack. No authentication is required; the GetEndpoints service is typically accessible before any credentials are exchanged. No user interaction or special client configuration is needed—a basic OPC UA client or custom script suffices. Network accessibility is the only prerequisite: if the open62541 server is reachable on the network (typically TCP port 4840 or a configured alternative), it is vulnerable. The attack requires no special privileges and no technical sophistication beyond crafting a malformed OPC UA message. An attacker can sustain the attack using multiple parallel connections to accelerate memory depletion, making mitigation through simple rate-limiting insufficient without a code-level fix.

Remediation

The primary remediation is to upgrade open62541 to a patched version once available from the project maintainers. Organizations should verify the vendor advisory for specific version recommendations. Until a patch is applied, network segmentation is critical: restrict network access to the OPC UA server to only trusted clients and networks. Implement firewall rules that limit connections to the OPC UA port from known, authorized sources. Monitor SecureChannel connection lifecycle and memory consumption; configure aggressive timeout policies to reduce the window during which buffered chunks persist. These mitigations reduce—but do not eliminate—risk without a code fix.

Patch guidance

Monitor the open62541 GitHub repository and official security advisories for patched versions. When updates are released, prioritize deployment in order of network exposure: internet-facing servers first, then those on untrusted or shared networks. Test patches in a non-production environment to confirm compatibility with dependent applications. After patching, verify that the GetEndpoints service correctly rejects oversized or malformed requests and does not buffer unbounded message lengths.

Detection guidance

Monitor for abnormal patterns indicative of exploitation: sustained high memory usage coinciding with OPC UA server activity; rapid creation and timeout of OPC UA SecureChannels without successful session establishment; repeated requests to the GetEndpoints service from the same or multiple sources; and error logs indicating message parsing failures or premature channel closures. Network-based detection is limited due to the early protocol stage, but packet inspection for GetEndpointsRequest messages with declared string lengths vastly exceeding typical endpoint URLs may flag suspicious activity. Establish baseline memory and connection metrics for your open62541 deployment to make deviations conspicuous.

Why prioritize this

This vulnerability warrants high-priority remediation despite the lack of current KEV listing. The combination of effortless exploitability, no authentication requirement, pre-session attack surface, high denial-of-service impact, and the breadth of OPC UA deployment in critical infrastructure creates substantial risk. The CVSS 7.5 HIGH rating reflects the severity of availability impact. Organizations should treat patching as urgent unless the affected server is isolated on a fully trusted, air-gapped network.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible attack vector requiring no privileges or user interaction, but with impact limited to availability. The lack of integrity or confidentiality compromise prevents a critical rating. However, the real-world risk may exceed this numerical score for organizations where OPC UA service availability is business-critical or safety-critical; in those contexts, availability loss directly translates to operational and potentially physical consequences.

Frequently asked questions