CVE-2026-33592: open62541 Memory Exhaustion DoS Vulnerability

CVE-2026-33592 Overview

CVE-2026-33592 is a memory exhaustion vulnerability in the open62541 OPC UA implementation. An unauthenticated remote attacker can exhaust server memory through the FindServers Discovery Service by abusing the serverUris field of FindServersRequest. The field is not validated for string length or array size, allowing an attacker to declare a string of up to approximately 3.9 GB. Chunks are buffered in RAM indefinitely until the SecureChannel times out. The attack occurs pre-session and bypasses all encryption configuration. The issue affects open62541 versions 1.4.0 through 1.4.16, 1.5.0 through 1.5.4, and the master branch.

Critical Impact
A single unauthenticated attacker can consume gigabytes of server RAM per SecureChannel, causing denial of service on OPC UA servers used in industrial control environments.

Affected Products

open62541 versions 1.4.0 through 1.4.16
open62541 versions 1.5.0 through 1.5.4
open62541master branch

Discovery Timeline

2026-07-02 - CVE-2026-33592 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-33592

Vulnerability Analysis

The vulnerability resides in the OPC UA Discovery Service implementation in open62541. The FindServers service processes a FindServersRequest message containing a serverUris array of strings. The server does not enforce upper bounds on the declared string length or array size before allocating and buffering chunk data. This maps to [CWE-770] Allocation of Resources Without Limits or Throttling.

OPC UA supports chunked message transport, where large messages are split across multiple MSG chunks and reassembled on the receiver. An attacker can declare a serverUris element with an arbitrary length prefix, then send intermediate chunks that the server continues to buffer while awaiting the final chunk. If the attacker never sends the terminating chunk, the server retains buffered data until the SecureChannel timeout expires.

Because the request is processed before any session is established, no credentials, certificates, or encryption configuration are required. The attack succeeds against servers configured for the strictest OPC UA security profiles.

Root Cause

The root cause is missing input validation on FindServersRequest.serverUris. Neither the declared string length nor the total array size is checked against a sane maximum before chunk reassembly buffers grow. The chunk buffering logic accumulates payload data across intermediate chunks without imposing a memory ceiling per SecureChannel.

Attack Vector

A remote attacker opens a TCP connection to the OPC UA server endpoint and performs the Hello and OpenSecureChannel handshake. The attacker then issues a FindServersRequest where serverUris declares an element approaching 3.9 GB. Intermediate chunks are transmitted, but the final chunk is withheld. The server allocates and holds the reassembly buffer until SecureChannel timeout. Repeating the attack across multiple connections multiplies memory consumption and forces the OPC UA process into out-of-memory conditions.

No verified public exploit code is available. Refer to the open62541 Pull Request #8142 for the technical fix and additional detail on the affected code paths.

Detection Methods for CVE-2026-33592

Indicators of Compromise

Sustained memory growth in the open62541 server process without a corresponding increase in active sessions.
Multiple long-lived SecureChannels from a single source IP that never complete a FindServers request.
Incoming OPC UA MSG chunks where declared message size is disproportionate to the negotiated receiveBufferSize.
Repeated SecureChannel timeouts on the Discovery endpoint (TCP 4840 by default).

Detection Strategies

Inspect OPC UA traffic on port 4840 for FindServersRequest messages carrying oversized serverUris length prefixes.
Correlate process memory usage of open62541-based servers with connection counts to identify anomalous growth per connection.
Alert on chunked OPC UA messages that never receive a final F chunk within the SecureChannel lifetime.

Monitoring Recommendations

Monitor resident set size (RSS) and virtual memory of OPC UA server processes with alerting thresholds tuned to baseline traffic.
Log SecureChannel open, timeout, and close events with source IP for post-incident analysis.
Track the ratio of completed to timed-out FindServers requests as an anomaly signal.

How to Mitigate CVE-2026-33592

Immediate Actions Required

Upgrade open62541 to a patched release once published beyond 1.4.16 and 1.5.4, or apply the fix from Pull Request #8142.
Restrict network reachability of OPC UA Discovery endpoints to trusted industrial network segments only.
Reduce the SecureChannel timeout on affected servers to shorten the window during which buffered chunks persist.

Patch Information

The fix is tracked in the upstream repository at open62541/open62541 via Pull Request #8142. The change log introduces length and size validation on the serverUris field and enforces bounds on chunk reassembly. Vendors that embed open62541 in industrial products should ship updated firmware or software releases incorporating this change.

Workarounds

Place OPC UA servers behind a firewall or industrial DMZ that allows connections only from known engineering workstations and clients.
Configure network-level rate limiting on TCP 4840 to cap the number of concurrent SecureChannels per source IP.
Lower the maxSecureChannels and maxChunkCount server configuration values to bound aggregate memory consumption per host.

bash

# Example iptables rule to limit concurrent connections per source to the OPC UA port
iptables -A INPUT -p tcp --dport 4840 -m connlimit \
  --connlimit-above 4 --connlimit-mask 32 -j REJECT