An unauthenticated remote attacker can exhaust
server memory via the GetEndpoints Discovery Service in open62541. The
endpointUrl field of GetEndpointsRequest i…

CVE-2026-11946 is a denial-of-service vulnerability in open62541, a popular open-source OPC UA library. An unauthenticated remote attacker can exhaust server memory by exploiting the GetEndpoints Discovery Service, where the endpointUrl field lacks length validation. The attacker declares an arbitrarily large string (up to ~4.09 GB) via the UInt32 length field, delivered in intermediate chunks without ever sending the final chunk. The server buffers all chunks in RAM indefinitely until the SecureChannel times out, effectively causing memory exhaustion. The attack is pre-session, requires no authentication, and bypasses all encryption configurations. Affected versions include open62541 1.4.0 through 1.4.16, 1.5.0 through 1.5.4, and the master branch. A fix has been proposed via a pull request on the project's GitHub repository.