CVE-2026-63252

Analyzed Analyzed - Analysis Complete

UASC Server Memory Leak in Eclipse Milo

Publication date: 2026-08-04

Last updated on: 2026-08-05

Assigner: Eclipse Foundation

Description

In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message chunks when a channel disconnects, allowing a remote unauthenticated client to exhaust pooled direct memory by repeatedly sending incomplete chunks and disconnecting, potentially terminating the server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-04

Last Modified

2026-08-05

Generated

2026-08-24

AI Q&A

2026-08-04

EPSS Evaluated

2026-08-23

NVD

CVE-2026-63252

EUVD

EUVD-2026-52662

Affected Vendors & Products

Vendor	Product	Version / Range
eclipse	milo	From 0.6.0 (inc) to 1.1.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Executive Summary

This vulnerability affects Eclipse Milo versions 0.6.0 through 1.1.4. It involves UASC server transport handlers failing to release retained partial message chunks when a channel disconnects. A remote unauthenticated client can repeatedly send incomplete chunks and disconnect, causing direct memory exhaustion in pooled memory and potentially terminating the server.

Detection Guidance

Monitor for high memory usage or server crashes in Eclipse Milo versions 0.6.0 through 1.1.4. Check for repeated disconnections or incomplete message chunks in logs. Use system monitoring tools like top, htop, or jstack to observe memory consumption and potential leaks.

Impact Analysis

The vulnerability allows an attacker to exhaust system memory by sending malformed messages, which could crash the server or degrade performance. This may lead to denial of service, disrupting services relying on Eclipse Milo for OPC UA communication.

Compliance Impact

This vulnerability could lead to denial-of-service conditions by exhausting server memory, which may disrupt availability of systems handling sensitive data. For GDPR, this could impact the right to access or availability of services. For HIPAA, it may affect the integrity and availability of protected health information systems. However, the provided context does not explicitly link this vulnerability to specific compliance failures or regulatory impacts.

Mitigation Strategies

Upgrade Eclipse Milo to a version beyond 1.1.4 where the vulnerability is fixed. If upgrading is not immediately possible, restrict network access to the UASC server transport handlers or disable them if not required.

Hi! I’m here to help you understand CVE-2026-63252. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70