An unauthenticated attacker can exhaust server memory using the Find servers' serverUris field in the request, which is not limited in length or array size. This lack of input validation creates a weakness that falls under CWE-770 (Uncontrolled Resource Consumption) and CWE-789 (Memory Allocation). The attacker can send a string up to roughly 3.9 GB split across many chunks, and the server buffers all chunks in RAM indefinitely until the channel times out. Because the attack happens before a session is established, it bypasses authentication and encryption, producing an immediate denial of service.

The flaw affects the open62541 project, maintained by o6 Automation GmbH. Vulnerable releases include 1.4.0 through 1.4.16, 1.5.0 through 1.5.4, and the current master branch. Any deployment that exposes the FindServers Discovery Service without the patch is susceptible.

With a CVSS score of 7.5 the vulnerability is classified as high severity. The EPSS score of < 1 % indicates a very low but non‑zero likelihood of exploitation, and it is not yet listed in the CISA KEV catalog, implying no publicly known exploits. The pre‑session, unauthenticated attack can be launched from any network that can reach the server's Discovery Service, which can lead to memory exhaustion and service interruption.