CVE-2026-61387: Eclipse Milo DoS Vulnerability

CVE-2026-61387 Overview

CVE-2026-61387 affects Eclipse Milo, an open-source implementation of the OPC Unified Architecture (OPC UA) protocol used in industrial automation deployments. The vulnerability spans versions 1.0.0 through 1.1.4 and stems from non-exception-safe monitored-item quota accounting in the server. An unauthenticated remote attacker can send a CreateMonitoredItems request containing deeply nested PubSub ExtensionObject values in the event filter. Decoding these nested objects triggers a StackOverflowError, and the server-global monitored-item reservation is never released. Repeated requests exhaust the finite global quota and prevent legitimate clients from creating new monitored items until the server restarts.

Critical Impact
Unauthenticated remote attackers can permanently exhaust the global monitored-item quota of an Eclipse Milo OPC UA server, blocking all new subscriptions until the process is restarted.

Affected Products

Eclipse Milo 1.0.0 through 1.1.4
OPC UA server deployments built on the eclipse:milo stack
Industrial automation and IoT gateways embedding Milo

Discovery Timeline

2026-08-04 - CVE-2026-61387 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-61387

Vulnerability Analysis

The flaw is a resource-exhaustion issue [CWE-400] in the OPC UA subscription service. When a client calls CreateMonitoredItems, the server first reserves a slot against a finite global counter, then decodes the request and instantiates the item. If decoding the event filter throws an unchecked error such as StackOverflowError, the reservation is not rolled back. The counter drifts upward with every failed attempt.

An attacker delivers the failure condition by embedding deeply nested PubSub ExtensionObject values inside the event filter. Existing subscriptions and other server operations continue functioning, but no client can create new monitored items until an operator restarts the process.

Root Cause

Two defects combine. First, the ExtensionObject decoder in opc-ua-stack/stack-core performs unbounded recursion, allowing nested payloads to overflow the JVM call stack. Second, the monitored-item quota accounting uses a reserve-then-construct pattern without a try/finally guard, so unchecked Error types bypass the release path. StackOverflowError extends VirtualMachineError, which most Java code does not catch, making the leak deterministic.

Attack Vector

Exploitation requires only network reachability to the OPC UA endpoint. No authentication and no user interaction are needed. The attacker opens a session, issues a CreateMonitoredItems request whose event filter contains recursively wrapped ExtensionObject payloads, and observes the failed response. Each request permanently consumes one slot from the global reservation counter. The upstream fix introduces a ThreadLocal<Integer> recursion counter to bound decoding depth.

java

 public abstract sealed class ExtensionObject
     permits ExtensionObject.Binary, ExtensionObject.Json, ExtensionObject.Xml {

+  private static final ThreadLocal<Integer> DECODE_DEPTH = ThreadLocal.withInitial(() -> 0);
+
   private final Lazy<UaStructuredType> decoded = new Lazy<>();

Source: eclipse-milo commit 587e356

Detection Methods for CVE-2026-61387

Indicators of Compromise

Repeated CreateMonitoredItems requests from a single client returning service faults or Bad_InternalError
Server logs containing java.lang.StackOverflowError originating in ExtensionObject decoding paths
Steadily rising monitored-item usage metric without a corresponding increase in active subscriptions
Legitimate clients receiving Bad_TooManyMonitoredItems despite low observed subscription counts

Detection Strategies

Alert on OPC UA sessions that issue high rates of CreateMonitoredItems calls with non-zero failure ratios
Correlate JVM error stack traces referencing org.eclipse.milo.opcua.stack.core.types.builtin.ExtensionObject with subsequent quota-exhaustion errors
Baseline the ratio of successful to failed monitored-item creations per client and flag deviations

Monitoring Recommendations

Export Milo server metrics for global monitored-item usage and alert when utilization trends upward without matching subscription growth
Capture OPC UA protocol telemetry at the network edge to inspect CreateMonitoredItems payload sizes and nesting depth
Forward JVM error logs to a central log platform and search for StackOverflowError originating in OPC UA decoders

How to Mitigate CVE-2026-61387

Immediate Actions Required

Upgrade Eclipse Milo to a release that includes commits 587e3566 and 5f3f6da2, which bound ExtensionObject decoding recursion
Restrict network access to OPC UA endpoints so only trusted client subnets can reach TCP port 4840
Restart affected Milo server processes to reset drifted monitored-item quota counters after suspected exploitation
Enable OPC UA session authentication and disable anonymous access where operationally feasible

Patch Information

The Eclipse Milo project addressed the issue in two commits. Commit 587e35669f519b2d7f6d850a5f86ee5a76c3a2c5 bounds recursive ExtensionObject decoding using a ThreadLocal depth counter. Commit 5f3f6da2a5ea80682e1da7c58f7a1870b09d2b43 hardens the quota accounting so failed item creation releases the reservation. See the Eclipse vulnerability report for full advisory details.

Workarounds

Place the OPC UA server behind a protocol-aware firewall or gateway that rejects CreateMonitoredItems requests exceeding a reasonable payload size or nesting depth
Require certificate-based user authentication and disable the Anonymous user token policy on the Milo endpoint
Schedule periodic restarts of Milo servers exposed to untrusted networks as a temporary containment measure until patching is complete

bash

# Update Milo dependency to a patched release in Maven
mvn versions:set-property -Dproperty=milo.version -DnewVersion=1.1.5
mvn clean install