An unauthenticated remote attacker can exhaust server memory via the FindServers Discovery Service in open62541. The serverUris field of FindServersRequest is not limited in length or array size, permitting an attacker to assert an arbitrarily large string—up to roughly 3.9 GB—delivered across many chunks. The server buffers each chunk in RAM and retains the buffer until the SecureChannel times out, resulting in uncontrolled resource consumption (CWE‑770) and excessive memory allocation (CWE‑789). Because the vulnerability is exercised before session establishment, authentication and encryption do not mitigate it, leading to an immediate denial of service.

The flaw affects the open62541 project, maintained by o6 Automation GmbH. Vulnerable releases include 1.4.0 through 1.4.16, 1.5.0 through 1.5.4, as well as the current master branch; any deployment exposing the FindServers Discovery Service without the patch is susceptible.

The CVSS score of 7.5 classifies the vulnerability as high severity. An EPSS score of < 1 % indicates a very low but non‑zero exploitation likelihood, and the vulnerability is not listed in CISA KEV, meaning no known exploits have been documented. The unauthenticated, pre‑session attack can be launched from any network that can reach the server’s Discovery Service interruption.