Memory Exhaustion in open62541 FindServersRequest

Executive Summary

This vulnerability allows an unauthenticated remote attacker to exhaust the server's memory by exploiting the FindServers Discovery Service in open62541.

Specifically, the serverUris field of the FindServersRequest is not validated for length or array size, enabling an attacker to declare an arbitrarily large string (up to approximately 3.9 GB) delivered across multiple intermediate chunks without ever sending the final chunk.

The server buffers all these chunks in RAM indefinitely until the SecureChannel times out, leading to memory exhaustion.

This attack occurs before any session is established and bypasses all encryption configurations.

The issue affects open62541 versions from 1.4.0 through 1.4.16, 1.5.0 through 1.5.4, and the master branch.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a denial-of-service (DoS) condition by exhausting the server's memory resources.

An attacker can cause the server to consume excessive RAM by sending large, incomplete requests that are buffered indefinitely.

As a result, legitimate users may experience degraded performance or complete unavailability of the affected open62541 server.

Since the attack is unauthenticated and bypasses encryption, it can be executed remotely without any credentials.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves an unauthenticated remote attacker sending an arbitrarily large string in the serverUris field of FindServersRequest, delivered across many intermediate chunks without a final chunk, causing the server to buffer all chunks in RAM indefinitely.

Detection on your network or system would involve monitoring for unusually large or incomplete FindServersRequest messages being sent to the open62541 server, especially those that do not complete and cause memory usage to increase abnormally.

Specific commands or tools are not provided in the available resources or CVE description. However, network traffic analysis tools like Wireshark or tcpdump could be used to capture OPC UA traffic and filter for FindServersRequest messages with large or fragmented serverUris fields.

Additionally, monitoring server memory usage and logs for signs of memory exhaustion or unusually long-lived SecureChannel sessions without completion could help detect exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update the open62541 server to a version that includes the fix which enforces default message and chunk size limits.

The fix introduces safe default limits of 512 MB per message and 16,384 chunks when the configuration values tcpMaxMsgSize or tcpMaxChunks are set to zero, preventing attackers from sending excessively large messages or unlimited chunks that exhaust server memory.

If updating immediately is not possible, configure the server to set explicit limits on tcpMaxMsgSize and tcpMaxChunks to reasonable values to prevent unbounded memory usage.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0