An unauthenticated remote attacker can exhaust server memory by abusing the GetEndpoints Discovery Service in open62541. The endpointUrl field of GetEndpointsRequest is not validated for length, permitting an attacker to declare an arbitrarily large string, up to roughly 4.09 GB, split across many fragments and never sending the final fragment. The server buffers each chunk in RAM indefinitely until the SecureChannel times out, which can lead to a crash or severe slowdown of This flaw is an uncontrolled memory allocation vulnerability driven by improper input validation and lack of resource limits, and it bypasses all encryption configurations, making the attack pre‑session and easier to execute.

1.4.0 through 1.4.16, 1.5.0 through 1.5.4, and master. All these releases of open62541 (maintained by o6 Automation GmbH) are vulnerable to the described memory exhaustion because they lack the length check on the endpointUrl field.

The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1 % suggests a low but non‑zero likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Nevertheless, an attacker can trigger the bug before establishing a session and without relying on encryption, presenting an appealing DoS vector for disrupting OPC UA services. Once the memory limit is reached, the server may become unresponsive or crash, allowing the attacker to deny legitimate clients access.