The vulnerability in Eclipse Milo occurs when the server’s monitored‑item quota accounting fails to restore reservations if a `CreateMonitoredItems` call fails with an unchecked error, such as a `StackOverflowError` triggered by deeply nested PubSub ExtensionObjects. This flaw allows a client to exhaust the finite global monitored‑item quota, preventing all clients from creating new monitored items until the server is restarted. Existing monitored items and other server functions remain operational, but the lack of new items effectively disables critical PubSub functionality. The weakness corresponds to CWE-400 (Resource Exhaustion), CWE-460 (Use of Externally Controlled Variable), and CWE-772 (Resource Leak), reflecting the failure to correctly manage and release resources upon error. The affected systems are the Eclipse Foundation’s Eclipse Milo Open‑Source OPC UA PubSub implementation, specifically the 1.0.0 through 1.1.4 releases. These are widely used in industrial and IoT environments to provide real‑time data distribution. The vulnerability is documented in commit references that patch the issue in newer releases. Risk and exploitability assessment shows a CVSS score of 6.9, indicating moderate severity. EPSS information is not available, and the vulnerability has not been identified in the CISA KEV catalog. The likely attack vector is an unauthenticated remote client that crafts a malicious `CreateMonitoredItems` request with a deeply nested filter. The lack of authentication requirements means any client able to reach the server can trigger the stack overflow, leading to quota exhaustion and denial of service. The conditions for exploitation are minimal: network connectivity to the OPC UA endpoint and the ability to send a malformed CreateMonitoredItems request.

The vulnerability applies to the Eclipse Foundation’s Eclipse Milo Open‑Source OPC UA PubSub implementation, versions 1.0.0 through 1.1.4. These releases are commonly deployed in industrial and IoT settings to enable real‑time data distribution via the OPC UA PubSub protocol. The affected component is the server’s monitored‑item quota accounting logic that tracks the number of monitored items server‑wide.

The CVSS score of 6.9 indicates moderate severity, reflecting the potential for resource exhaustion without a requirement for authentication. EPSS data is not available, and the vulnerability is not present in the CISA KEV catalog, which suggests that while it may be exploited, there is currently no known active exploitation. The flaw can be triggered through a crafted `CreateMonitoredItems` request that includes deeply nested PubSub ExtensionObjects, causing a `StackOverflowError` during decoding. The resulting lack of quota restoration allows an unauthenticated remote client to exhaust the finite global monitored‑item quota, effectively denying new monitored items to all clients until the server is restarted.