CVE-2026-61387
Received Received - Intake

StackOverflowError in Eclipse Milo Monitored-Item Quota Exhaustion

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: Eclipse Foundation

Description
In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server-global reservation is not restored. Deeply nested PubSub ExtensionObjects in a `CreateMonitoredItems` event filter can trigger a `StackOverflowError` during decoding, allowing an unauthenticated remote client to exhaust a finite global monitored-item quota and prevent all clients from creating new monitored items until restart. Existing monitored items and other server functions remain unaffected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-61387
EUVD
EUVD-2026-52659

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
eclipse milo From 1.0.0 (inc) to 1.1.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
CWE-460 The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.
CWE-772 The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Eclipse Milo OPC UA server versions 1.0.0 to 1.1.4. It involves improper handling of monitored-item quota when item creation fails due to an unchecked error. Specifically, a deeply nested PubSub ExtensionObject in a CreateMonitoredItems event filter can trigger a StackOverflowError during decoding. This allows an unauthenticated remote client to exhaust the global monitored-item quota, preventing all clients from creating new monitored items until the server restarts.

Detection Guidance

Monitor for excessive monitored item creation attempts or quota exhaustion events in Eclipse Milo server logs. Check for StackOverflowError traces during OPC UA PubSub ExtensionObject decoding. Use network monitoring tools to detect unauthenticated clients sending deeply nested PubSub ExtensionObjects in CreateMonitoredItems requests.

Impact Analysis

An unauthenticated attacker could exploit this to crash the server's ability to create new monitored items by sending specially crafted requests. This would disrupt all client applications relying on the OPC UA server for data monitoring, leading to denial of service for monitoring operations until the server is restarted.

Mitigation Strategies

Update Eclipse Milo to version 1.1.5 or later which includes the quota exception-safety fix. If immediate update is not possible, implement network-level restrictions to block unauthenticated clients from sending CreateMonitoredItems requests with complex PubSub ExtensionObjects.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61387. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart