CVE-2026-67856 Overview
CVE-2026-67856 is a denial-of-service vulnerability affecting open62541 version 1.5.5 and earlier. The open62541 library is an open source implementation of OPC UA (Open Platform Communications Unified Architecture), widely used in industrial automation and Internet of Things (IoT) environments. A remote attacker can trigger resource exhaustion by sending crafted subscription-related requests, including CreateSubscription, CreateMonitoredItems (Sampling), Publish, TransferSubscriptions, and DeleteSubscriptions. Successful exploitation causes the OPC UA server to become unresponsive, disrupting availability of industrial control communications. The weakness is classified as [CWE-400] Uncontrolled Resource Consumption.
Critical Impact
Unauthenticated remote attackers can render open62541-based OPC UA servers unavailable, disrupting industrial and IoT operations that depend on real-time telemetry and control.
Affected Products
- open62541 version 1.5.5
- open62541 versions prior to 1.5.5
- OPC UA server deployments built on the affected open62541 releases
Discovery Timeline
- 2026-08-04 - CVE-2026-67856 published to the National Vulnerability Database (NVD)
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-67856
Vulnerability Analysis
The vulnerability resides in the subscription service handling code of open62541, implemented across ua_services_subscription.c, ua_subscription.c, and ua_subscription.h. OPC UA subscriptions maintain server-side state for monitored items, publish queues, and lifecycle transitions. When a client issues crafted requests to the subscription services, the server allocates and manages resources without sufficient bounds or lifecycle enforcement.
Repeatedly invoking CreateSubscription, CreateMonitoredItems, Publish, TransferSubscriptions, and DeleteSubscriptions in specific sequences drives excessive resource consumption. The server exhausts memory, CPU, or internal queue capacity, halting responses to legitimate clients. Because the affected code paths are reachable over the network prior to strict authorization checks in default configurations, the attack requires no privileges.
Root Cause
The root cause is uncontrolled resource consumption [CWE-400] in the subscription lifecycle. The service functions do not adequately cap the number of subscriptions, monitored items, or queued notifications per session, nor do they reclaim resources deterministically when clients issue malformed or high-volume request sequences. Details are tracked in the upstream GitHub Issue #8092.
Attack Vector
The attack is remote and network-based. An attacker establishes an OPC UA session to a vulnerable server, then issues a crafted sequence of subscription and monitored-item requests. The example server in server_access_control.c illustrates default access paths that expose subscription services. Impact is limited to availability; confidentiality and integrity are not affected.
No verified public exploit code is available. See the upstream subscription source in ua_services_subscription.c and ua_subscription.c for the affected code paths.
Detection Methods for CVE-2026-67856
Indicators of Compromise
- Sudden spike in CreateSubscription or CreateMonitoredItems requests from a single OPC UA session or client endpoint.
- Sustained growth in server memory, CPU, or thread count coinciding with subscription service traffic.
- Repeated TransferSubscriptions or DeleteSubscriptions calls followed by session hangs or timeouts on legitimate clients.
Detection Strategies
- Instrument OPC UA servers to log per-session counts of active subscriptions and monitored items, and alert when thresholds are exceeded.
- Deploy network monitoring for OPC UA traffic (default TCP port 4840) to identify abnormal request rates against subscription services.
- Correlate server process health metrics with OPC UA session events to identify resource-exhaustion patterns.
Monitoring Recommendations
- Track availability of OPC UA endpoints with active health checks and alert on service unresponsiveness.
- Capture and retain OPC UA session logs, including client endpoint URLs and authentication context, for post-incident analysis.
- Monitor host telemetry (memory, CPU, file descriptors) on systems hosting open62541 servers to detect exhaustion before full outage.
How to Mitigate CVE-2026-67856
Immediate Actions Required
- Inventory all open62541 deployments and identify versions at or below 1.5.5.
- Restrict network reachability of OPC UA endpoints to trusted operational networks using firewalls and network segmentation.
- Enforce authentication and disable anonymous access on OPC UA servers wherever the application permits.
Patch Information
At the time of publication, refer to the upstream open62541 project for fix status. Track remediation progress via GitHub Issue #8092 and apply the fixed release once available. Rebuild and redeploy any downstream products or firmware that statically link the vulnerable library.
Workarounds
- Configure server limits for maximum subscriptions per session, monitored items per subscription, and publish queue sizes to constrain resource use.
- Place OPC UA servers behind an application-aware gateway that rate-limits subscription service requests.
- Require certificate-based client authentication and remove the anonymous user policy on production servers.
# Example: restrict OPC UA server exposure with host firewall (Linux)
# Allow OPC UA (TCP 4840) only from trusted operator subnet
iptables -A INPUT -p tcp --dport 4840 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 4840 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
