CVE-2026-33592

HighCVSS 7.5/10Last modified Jul 2, 2026

Description

An unauthenticated remote attacker can exhaust server memory via the FindServers Discovery Service in open62541. The serverUris field of FindServersRequest is not validated for length or array size. An attacker can declare an arbitrarily large string (up to ~3.9 GB) delivered across intermediate chunks without ever sending the final chunk. The server buffers all chunks in RAM indefinitely until the SecureChannel times out. The attack is pre-session and bypasses all encryption configuration. The issue affects open62541: from 1.4.0 through 1.4.16, from 1.5.0 through 1.5.4, master.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770CWE-789

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Jul 2, 2026
Last modified
Jul 2, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-335937.5A client can trigger a divide by zero error leading to crash by sending a crafted DNSCrypt query.CVE-2026-335947.5A client can trigger excessive memory allocation by generating a lot of queries that are routed to an overloaded DoH backend, causing querieCVE-2026-335957.5A client can trigger excessive memory allocation by generating a lot of errors responses over a single DoQ and DoH3 connection, as some resoCVE-2026-335966.5A client might theoretically be able to cause a mismatch between queries sent to a backend and the received responses by sending a flood of CVE-2026-335977.5PRSD detection denial of serviceCVE-2026-335989.1A cached crafted response can cause an out-of-bounds read if custom Lua code calls getDomainListByAddress() or getAddressListByDomain() on aCVE-2026-335998.1A rogue backend can send a crafted SVCB response to a Discovery of Designated Resolvers request, when requested via either the autoUpgrade (CVE-2026-33607.5The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to an Insecure Direct Object Reference in all versioCVE-2026-336004.9An RPZ sent by a malicious authoritative server can result in a null pointer dereference, caused by a missing consistency check and leading CVE-2026-336014.9If you use the zoneToCache function with a malicious authoritative server, an attacker can send a zone that result in a null pointer dereferCVE-2026-336028.2A rogue backend can send a crafted UDP response with a query ID off by one related to the maximum configured value, triggering an out-of-bouCVE-2026-336035.3Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding. This requires that the at