CVE-2026-33592: open62541 OPC UA Denial of Service via Unbuffered FindServersRequest

Technical summary

The vulnerability exists in the FindServersRequest handler within open62541's Discovery Service. Specifically, the serverUris field lacks validation on string length and array size limits. An attacker constructs a request claiming a payload of up to ~3.9 GB, fragments it across multiple transport chunks, and intentionally withholds the final chunk. The server buffers all intermediate chunks in RAM without enforcing timeouts or size caps until the SecureChannel timeout (which is often on the order of minutes). Since this attack occurs pre-session—before channel authentication and encryption—standard OPC UA security profiles provide no protection. The root cause is improper input validation combined with unbounded buffering of incomplete messages (CWE-770: Allocation with Excessive Size Value; CWE-789: Memory Corruption).

Business impact

Organizations deploying open62541 as an OPC UA server—common in industrial automation, manufacturing, building management, and critical infrastructure environments—face immediate availability risk. An unauthenticated attacker anywhere on the network can remotely crash the server with a single malicious request, disrupting real-time control and monitoring capabilities. Because the attack is pre-authentication, even servers in air-gapped or restricted networks may be vulnerable if accessed by a compromised internal system. Recovery requires manual restart. In environments where OPC UA servers manage time-sensitive or safety-critical processes, this denial-of-service can have cascading consequences beyond simple downtime.

Affected systems

The vulnerability affects open62541 versions 1.4.0 through 1.4.16, all 1.5.0 through 1.5.4 releases, and the master development branch. Any deployment of these versions with the FindServers Discovery Service enabled is vulnerable. Organizations using open62541 in embedded systems, gateway devices, or standalone OPC UA server applications should treat this as high-priority. Downstream products or distributions that bundle open62541 may also be affected; verify with your vendor if you use any OPC UA-based software stack.

Exploitability

Exploitability is very high. The attack requires no authentication, no user interaction, and no special network position—a basic network socket and ability to construct an OPC UA FindServersRequest is sufficient. The payload can be crafted with common tools; no zero-day exploit code is required. Attack detection is difficult because the network traffic is valid OPC UA protocol; the malice lies in the incomplete message and lack of validation. The attacker has full control over timing and can tune the attack to crash the server or consume all memory depending on available resources. Public exploitation is likely once technical details circulate.

Remediation

Upgrade to a patched version of open62541 as soon as one is released by the project maintainers. Verify the specific patched version against the official open62541 repository and security advisories. Until a patch is available, mitigate by restricting network access to the Discovery Service (typically port 4840) using firewall rules, network segmentation, or access control lists. Disable the FindServers Discovery Service if it is not required for your operations. Implement rate limiting and connection timeouts at the transport layer. Monitor memory usage and process health; configure alerts for abnormal RAM consumption or server restarts. These compensating controls reduce but do not eliminate risk.

Patch guidance

Monitor the open62541 GitHub repository and official security channels for patch releases. When available, prioritize upgrades to the earliest patched version in your currently deployed minor release branch (e.g., if running 1.4.x, upgrade to the first 1.4.z with the fix). Test patches in a staging environment mirroring your production OPC UA topology before rollout, as OPC UA server updates may affect connected clients or dependent systems. Plan for server restarts during a maintenance window. If you are on an older major version unsupported by the project, consider a strategic upgrade to a newer, maintained branch.

Detection guidance

Monitor open62541 process memory consumption for unexplained spikes or sustained growth. Enable OPC UA stack logging (if available in your deployment) to capture FindServersRequest messages and flag those with suspiciously large declared payload sizes or repeated incomplete messages from the same source. Network-level detection: identify FindServersRequest packets with oversized declared field lengths that are not followed by complete transmission; tools like Zeek or Suricata with OPC UA modules can be configured to alert on such patterns. Correlate crashed or restarted servers with incoming FindServersRequest traffic from external sources. Check server logs for SecureChannel timeout events that coincide with memory exhaustion.

Why prioritize this

This vulnerability merits immediate attention due to its combination of high CVSS score (7.5), zero authentication requirement, network-accessible attack vector, and ease of exploitation. The impact is direct denial of service with no user interaction required. While not currently listed in CISA's Known Exploited Vulnerabilities catalog, the technical simplicity and public nature of OPC UA deployments in critical sectors (energy, water, manufacturing) elevate practical risk. Early patching prevents trivial attacks that require minimal sophistication from adversaries.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects: Network-accessible attack surface (AV:N), no authentication required (PR:N), no user interaction (UI:N), and a high availability impact (A:H). The scope is unchanged (S:U) because the denial of service is localized to the attacked service. No confidentiality or integrity impact (C:N, I:N) because memory exhaustion does not leak data or corrupt records. The score appropriately captures the practical risk: an unauthenticated attacker can trivially disable a networked service, but does not gain code execution or data access. Organizations should not mistake a 7.5 as 'moderate risk'—in availability-critical environments, this is a severe issue.

Frequently asked questions