CVE-2026-67858
CVE-2026-67858
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Buffer Overflow vulnerability exists in open62541 1.5.5 when the Local Discovery Server (LDS) is built with multicast discovery enabled through the MDNSD backend. An unauthenticated remote attacker can send a RegisterServer or RegisterServer2 request containing many unique discoveryUrls. This allows remote attackers to cause a denial of service.
CVSS 7.5 · High · EPSS 0.9%
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
open62541 Debian:13
- Versions
- 1.4.11.1-1
- 1.4.18-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
open62541 Debian:14
- Versions
- 1.4.11.1-1
- 1.4.18-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
open62541 Ubuntu:26.10
- Versions
- 1.4.11.1-1build1
- 1.4.18-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
open62541 Ubuntu:26.04:LTS
- Versions
- 1.4.11.1-1
- 1.4.11.1-1build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://github.com/open62541/open62541/issues/8094
- https://github.com/open62541/open62541/tree/master/examples/discovery
- https://github.com/open62541/open62541/blob/master/src/server/ua_services_discovery.c
- https://github.com/open62541/open62541/blob/master/src/server/ua_discovery_mdns.c
- https://github.com/open62541/open62541/blob/master/doc/building.rst
- https://nvd.nist.gov/vuln/detail/CVE-2026-67858