Technical impact
This vulnerability allows a remote attacker to trigger a denial of service by sending specially crafted CreateSubscription, CreateMonitoredItems(Sampling), Publish, TransferSubscriptions, and DeleteSubscriptions requests to an open62541 server. The crafted messages cause the server to enter an unstable state that consumes resources or crashes, resulting in service interruption. No user privileges or authentication are required to exploit the flaw.
Affected Systems
The affected product is the open62541 OPC UA library, v1.5.5 and all earlier releases. Systems that embed this library within an OPC UA server are directly impacted. The issue is present in the core server implementation and the subscription handling code, which are referenced in the project's source files and issues. If a system uses a custom build that links against this library, it is also vulnerable unless the vulnerable version is omitted.
Risk and Exploitability
Because the flaw does not require authentication, any host reachable over the network can construct the malicious requests. The CVSS score is 7.5, but the lack of authentication combined with the remote nature of the attack indicates a high potential impact. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exhaust server resources or force a crash by repeatedly exploiting the subscription primitives.
