CVE-2026-67856

Received Received - Intake

Denial of Service in open62541

Publication date: 2026-08-04

Last updated on: 2026-08-05

Assigner: MITRE

Description

An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via crafted CreateSubscription, CreateMonitoredItems(Sampling), Publish, TransferSubscriptions, and DeleteSubscriptions requests

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-04

Last Modified

2026-08-05

Generated

2026-08-25

AI Q&A

2026-08-05

EPSS Evaluated

2026-08-23

NVD

CVE-2026-67856

Affected Vendors & Products

Vendor	Product	Version / Range
open62541	open62541	to 1.5.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability is a denial of service issue in open62541 versions 1.5.5 and earlier. It allows a remote attacker to disrupt services by sending specially crafted requests such as CreateSubscription, CreateMonitoredItems, Publish, TransferSubscriptions, and DeleteSubscriptions.

Detection Guidance

Detecting this vulnerability requires monitoring for abnormal OPC UA subscription-related traffic or crashes in open62541 versions 1.5.5 or earlier. Check open62541 logs for segmentation faults or errors during subscription operations. Use network monitoring tools like Wireshark to inspect for malformed CreateSubscription, Publish, or DeleteSubscriptions requests targeting OPC UA servers running affected versions.

Impact Analysis

If exploited, this vulnerability could cause your open62541-based system to become unresponsive or crash, leading to service disruptions. This may affect applications relying on OPC UA communication protocols.

Compliance Impact

The provided CVE data does not specify how this vulnerability affects compliance with standards like GDPR or HIPAA. The issue involves a denial of service via crafted requests, which could disrupt system availability but lacks details on regulatory impacts.

Mitigation Strategies

Upgrade open62541 to a version newer than v1.5.5 to address the DoS vulnerability in subscription-related requests.

Hi! I’m here to help you understand CVE-2026-67856. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70