The flaw resides in the NodeManagement type‑instantiation logic of the open62541 OPC UA library. An attacker who can send service requests to the server can repeatedly trigger node type creation, causing the server to allocate increasingly more resources or crash. The resulting vulnerability is a pure availability breach that can prevent legitimate clients from accessing OPC UA services. The weakness is captured by CWE‑400 (input validation) and CWE‑1287 (resource exhaustion).

Open62541 deployments running version 1.5.5 or earlier are affected regardless of operating system or network configuration, as the issue is confined to the server code and is not tied to external system settings.

Inferred from the text, the attack vector is remote, using the standard OPC UA endpoint. No authentication or privilege elevation is mentioned; therefore it is presumed that the vulnerability can be triggered by any remote client. The EPSS score of <1% and absence from CISA KEV suggest a low probability of widespread exploitation, yet the CVSS score of 7.5 conveys high severity. If exploited, the denial of service could disrupt industrial control systems that rely on open62541. No additional exploitation complexity factors are provided by the data.