Bug 2496405 (CVE-2026-33592)

Summary:	CVE-2026-33592 open62541: open62541: Remote attacker can cause Denial of Service via FindServers Discovery Service
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in open62541. An unauthenticated remote attacker can exhaust server memory by sending an arbitrarily large string in the `serverUris` field of the FindServersRequest, which is part of the FindServers Discovery Service. The server buffers these large strings indefinitely, leading to a Denial of Service (DoS) condition. This attack is pre-session and bypasses all encryption configurations.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2496477
Bug Blocks:

Description OSIDB Bzimport 2026-07-02 08:01:25 UTC

An unauthenticated remote attacker can exhaust
server memory via the FindServers Discovery Service in open62541. The
serverUris field of FindServersRequest is not validated for length or array
size. An attacker can declare an arbitrarily large string (up to ~3.9 GB)
delivered across intermediate chunks without ever sending the final chunk. The
server buffers all chunks in RAM indefinitely until the SecureChannel times
out. The attack is pre-session and bypasses all encryption configuration. The issue affects open62541: from 1.4.0 through 1.4.16, from 1.5.0 through 1.5.4, master.