CVE-2026-67861: open62541 DoS Vulnerability

CVE-2026-67861 Overview

CVE-2026-67861 is a denial of service vulnerability in open62541, an open-source implementation of the OPC Unified Architecture (OPC UA) protocol. The flaw affects versions 1.5.5 and earlier and resides in the UA_Client_getRemoteDataTypes component. A remote attacker can trigger the condition over the network without authentication or user interaction, causing the client process to become unresponsive. The issue is categorized under [CWE-400: Uncontrolled Resource Consumption]. Because open62541 is widely embedded in industrial control system (ICS) and Internet of Things (IoT) clients, the availability impact extends to operational technology environments.

Critical Impact
A network-based attacker can exhaust resources on any OPC UA client using open62541 v1.5.5 or earlier, leading to a denial of service against industrial and automation endpoints.

Affected Products

open62541 v1.5.5
open62541 versions prior to v1.5.5
Applications and appliances embedding the affected UA_Client_getRemoteDataTypes client utility

Discovery Timeline

2026-08-04 - CVE-2026-67861 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-67861

Vulnerability Analysis

The vulnerability resides in UA_Client_getRemoteDataTypes, a client-side utility that resolves custom data type definitions from a remote OPC UA server. When an open62541 client invokes this function against a malicious or malformed server, the client fails to properly bound resource consumption during type resolution. This uncontrolled processing leads to resource exhaustion on the client host.

The defect is a resource management flaw [CWE-400] rather than a memory corruption issue. Confidentiality and integrity are not affected, but availability of the client process is fully compromised. Because OPC UA is commonly deployed in supervisory control, telemetry aggregation, and human-machine interface (HMI) systems, a downed client can disrupt monitoring and control loops.

Root Cause

The root cause is uncontrolled resource consumption inside the remote data type retrieval routine. The client trusts the volume and shape of data type descriptors returned by the server without applying strict bounds. Details of the specific allocation or iteration behavior are tracked in the upstream issue at open62541 Issue #8140. Relevant source files include ua_client_util.c and the custom data type client example.

Attack Vector

Exploitation requires a target open62541 client to connect to an attacker-controlled OPC UA server or to a compromised server that returns crafted type metadata. Once the client calls UA_Client_getRemoteDataTypes, the malicious response drives the client into a resource-exhausting code path. The attack is network-based, requires no privileges, and needs no user interaction beyond the normal client connection to the endpoint. No public proof-of-concept is currently referenced in the advisory.

Detection Methods for CVE-2026-67861

Indicators of Compromise

open62541-based client processes exhibiting sustained high CPU or memory usage immediately after invoking UA_Client_getRemoteDataTypes or reading type dictionaries from a server.
Client crashes, hangs, or restarts correlated with outbound OPC UA sessions to previously unseen or untrusted servers.
Unexpected outbound OPC UA connections (default TCP/4840) from ICS or automation hosts to external endpoints.

Detection Strategies

Inventory all software embedding open62541 and identify versions at or below 1.5.5 using software composition analysis.
Monitor OPC UA client processes for abnormal memory growth or thread stalls following type discovery operations.
Alert on OPC UA client sessions to servers outside an approved allowlist of endpoints.

Monitoring Recommendations

Enable process-level telemetry on ICS engineering workstations and gateways that run open62541 clients.
Log OPC UA session establishment events and correlate them with client process health metrics.
Capture network flows on TCP/4840 and inspect for connections originating from operational technology segments to unapproved destinations.

How to Mitigate CVE-2026-67861

Immediate Actions Required

Identify every application, gateway, and appliance that ships open62541 v1.5.5 or earlier and prioritize them for patching.
Restrict open62541 clients so they connect only to trusted, authenticated OPC UA servers within segmented operational networks.
Block outbound OPC UA traffic from ICS hosts to untrusted networks at the firewall.

Patch Information

A fixed upstream release should be tracked through the open62541 GitHub issue #8140. Rebuild and redeploy any downstream product that statically links or vendors the open62541 library once a corrected version is released. Vendors integrating open62541 should publish coordinated advisories referencing CVE-2026-67861.

Workarounds

Avoid calling UA_Client_getRemoteDataTypes against untrusted servers until a fixed release is deployed.
Enforce OPC UA server certificate validation and use application allowlisting to prevent clients from negotiating sessions with unknown endpoints.
Apply network segmentation and firewall rules to isolate OPC UA clients from internet-reachable or third-party networks.

bash

# Example: restrict outbound OPC UA (TCP/4840) to an allowlist of trusted servers
iptables -A OUTPUT -p tcp --dport 4840 -d 10.10.20.5 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 4840 -d 10.10.20.6 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 4840 -j DROP