Description
open62541 contains a heap use-after-free in the GDS PushManagement certificate update workflow when UA_ENABLE_GDS_PUSHMANAGEMENT is enabled. This allows a remote attacker to cause a denial of service.
Published: 2026-08-04
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The CVE describes a heap use‑after‑free in the GDS PushManagement certificate update workflow of the open62541 OPC UA library when the UA_ENABLE_GDS_PUSHMANAGEMENT option is enabled. Exploiting this flaw allows a remote attacker to trigger a denial‑of‑service condition by causing the server to crash or reset during the certificate update process.

Affected Systems

Any installation of open62541 that is compiled with UA_ENABLE_GDS_PUSHMANAGEMENT enabled, such as embedded or custom OPC UA servers, is affected. The specific affected versions are not listed in the provided data.

Risk and Exploitability

A remote attacker can invoke the vulnerable certificate update routine over the network, leading to a crash. The vulnerability is a heap use‑after‑free (CWE‑825) and a resource exhaustion flaw (CWE‑400) with a CVSS score of 7.5. The EPSS score is < 1%, indicating a very low but non‑zero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation yet the impact remains significant for exposed servers.

Generated by OpenCVE AI on August 5, 2026 at 20:28 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to the latest stable release of open62541 that fixes the heap use‑after‑free in the GDS PushManagement certificate update workflow.
  • If an upgrade cannot be performed immediately, recompile the library with the UA_ENABLE_GDS_PUSHMANAGEMENT flag disabled to remove the vulnerable code path.
  • Apply the temporary patch from GitHub issue 8093 by incorporating the guarded free logic shown in repository's implementation, or implement an equivalent runtime guard to prevent the use‑after‑free.

Generated by OpenCVE AI on August 5, 2026 at 20:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 05 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 05 Aug 2026 14:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Wed, 05 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
Title Heap Use-After-Free in open62541 GDS PushManagement Allows Remote Denial of Service open62541: open62541: Denial of Service via heap use-after-free
Weaknesses CWE-825
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Important

Wed, 05 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
First Time appeared Open62541
Open62541 open62541
Vendors & Products Open62541
Open62541 open62541

Tue, 04 Aug 2026 22:45:00 +0000

Type Values Removed Values Added
Title Heap Use-After-Free in open62541 GDS PushManagement Allows Remote Denial of Service
Weaknesses CWE-416

Tue, 04 Aug 2026 21:45:00 +0000

Type Values Removed Values Added
Description open62541 contains a heap use-after-free in the GDS PushManagement certificate update workflow when UA_ENABLE_GDS_PUSHMANAGEMENT is enabled. This allows a remote attacker to cause a denial of service.
References

Subscriptions

Open62541 Open62541
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-08-05T18:54:07.071Z

Reserved: 2026-07-30T00:00:00.000Z

Link: CVE-2026-67855

cve-icon Vulnrichment

Updated: 2026-08-05T18:53:20.398Z

cve-icon NVD

Status : Received

Published: 2026-08-04T22:17:15.733

Modified: 2026-08-05T19:17:32.243

Link: CVE-2026-67855

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-04T00:00:00Z

Links: CVE-2026-67855 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-05T20:30:06Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-825

    Expired Pointer Dereference