CVE-2026-63362
CVE-2026-63362 · o6 Automation open62541 Integer Underflow
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An unsigned integer underflow in the PubSub signature verification path in open62541 may allow a remote attacker to cause a denial of service via a crafted UDP packet.
CVSS 8.2 · High · EPSS 1.8%
- Published
- Updated
Stack: system
Affected products and versions
open62541
- Versions
- ≥ 1.3.0, ≤ 1.3.17: Affected (custom)
- ≥ 1.4.0, ≤ 1.4.16: Affected (custom)
- ≥ 1.5.0, ≤ 1.5.4: Affected (custom)
- master: Affected
No fix published
open62541 Debian:13
- Versions
- 1.4.11.1-1
- 1.4.18-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
open62541 Debian:14
- Versions
- 1.4.11.1-1
- 1.4.18-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
open62541 Ubuntu:26.10
- Versions
- 1.4.11.1-1build1
- 1.4.18-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
open62541 Ubuntu:26.04:LTS
- Versions
- 1.4.11.1-1
- 1.4.11.1-1build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://www.o6-automation.com/contact
- https://github.com/open62541/open62541/pull/8235/commits/b666d35769ce63998442e4d0810a3fb10b50179f
- https://github.com/open62541/open62541/pull/8236/commits/06b99fef667c8ec5bdf0605b4f00c84fcc1d3a60
- https://github.com/open62541/open62541/pull/8237/commits/1b71d9c5d9c4d02d4729b8903a52e9f530bf804e
- https://github.com/open62541/open62541/pull/8238/commits/afab4107bfd161da9ce8bb30ed77f3968c9c97df
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-08
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-08.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-63362