CVE-2026-15690: open62541 DoS Vulnerability

CVE-2026-15690 Overview

CVE-2026-15690 is a null pointer dereference vulnerability in the open62541 OPC UA implementation, affecting versions up to 1.5.5. The flaw resides in the responseReadNamespacesArray function within src/client/ua_client_connect.c, part of the Shared Client Library component. Manipulation of the Server_NamespaceArray argument triggers the dereference [CWE-404]. The issue is exploitable over the network but requires low privileges and high attack complexity, limiting practical impact. A public exploit reference exists via VulDB. The open62541 project closed the corresponding issue, noting it was not filed through their official security disclosure channel.

Critical Impact
Successful exploitation causes a null pointer dereference in the shared client library, resulting in a denial-of-service condition against client applications consuming a malicious or malformed Server_NamespaceArray response.

Affected Products

open62541 versions up to and including 1.5.5
Shared Client Library component (src/client/ua_client_connect.c)
Applications embedding vulnerable open62541 client builds

Discovery Timeline

2026-07-14 - CVE-2026-15690 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-15690

Vulnerability Analysis

The vulnerability exists inside the responseReadNamespacesArray function, which processes namespace array responses returned by an OPC UA server during client connection setup. The function fails to validate a pointer derived from the Server_NamespaceArray argument before dereferencing it. When a crafted or unexpected value is supplied, the client dereferences a null pointer and crashes.

Because the affected code path executes on the client side during session negotiation, exploitation requires a client to connect to an attacker-controlled or compromised server. The impact is limited to availability of the client process. Confidentiality and integrity are not affected, per the assigned CVSS metrics.

The issue is tracked under [CWE-404: Improper Resource Shutdown or Release]. The open62541 maintainers closed the associated report on their issue tracker without applying a fix through that channel, citing that it was not submitted via their designated vulnerability disclosure process.

Root Cause

The root cause is missing input validation of the pointer returned from parsing the Server_NamespaceArray field before it is dereferenced in responseReadNamespacesArray. The function assumes a well-formed response and does not perform a null check.

Attack Vector

An attacker who controls or intercepts an OPC UA server response can send a malformed Server_NamespaceArray payload to a connecting open62541 client. Exploitation requires network reachability and low privileges. The attack complexity is high because it depends on precise response conditions during the client connect sequence. Successful exploitation crashes the client process.

No verified proof-of-concept code has been released. Technical details are referenced in the GitHub Issue Tracker and the VulDB Vulnerability Report.

Detection Methods for CVE-2026-15690

Indicators of Compromise

Unexpected termination or segmentation faults in processes linking the open62541 shared client library
Core dumps referencing responseReadNamespacesArray or ua_client_connect.c in stack traces
Repeated client reconnection attempts against a single OPC UA server endpoint following crashes

Detection Strategies

Inventory build artifacts and container images for open62541 versions at or below 1.5.5
Enable crash reporting and core dump collection on hosts running OPC UA client workloads
Inspect OPC UA server responses for anomalous or malformed NamespaceArray structures using protocol-aware monitoring

Monitoring Recommendations

Alert on abnormal process termination for industrial control and IoT client applications
Monitor outbound OPC UA connections from clients to unauthorized or unexpected server endpoints
Correlate client crash telemetry with recent connection events to untrusted servers

How to Mitigate CVE-2026-15690

Immediate Actions Required

Identify all deployments using open62541 client libraries at or below version 1.5.5
Restrict client connections to trusted, authenticated OPC UA server endpoints only
Enable process supervision and automatic restart for client applications to reduce availability impact

Patch Information

No official vendor patch has been referenced in the CVE record. The project closed the GitHub issue without publishing a coordinated fix, stating the report did not follow the official security disclosure process. Consult the open62541 GitHub Project Repository for the latest releases and apply updated versions once the maintainers issue a corrected build. Additional context is available in the VulDB CVE-2026-15690 entry.

Workarounds

Enforce mutual authentication and certificate pinning between OPC UA clients and known servers
Segment OPC UA client hosts on isolated networks to prevent connections to untrusted servers
Wrap client processes in supervisors that automatically restart on crash to preserve availability
Apply an in-house patch adding a null check on the Server_NamespaceArray pointer prior to dereference in responseReadNamespacesArray

bash

# Configuration example
# Verify installed open62541 version
pkg-config --modversion open62541

# Example: restrict outbound OPC UA traffic to approved server IPs (iptables)
iptables -A OUTPUT -p tcp --dport 4840 -d 10.0.0.10 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 4840 -j DROP