An unauthenticated remote attacker can exhaust
server memory via the FindServers Discovery Service in open62541. The
serverUris field of FindServersRequest is n…

CVE-2026-33592 is a denial-of-service vulnerability in open62541, a popular open-source OPC-UA library used in industrial and IIoT environments. An unauthenticated remote attacker can exhaust server memory by abusing the FindServers Discovery Service. The serverUris field in FindServersRequest lacks validation for length or array size, allowing an attacker to declare arbitrarily large strings (~3.9 GB) sent across intermediate chunks without ever delivering the final chunk. The server buffers all chunks in RAM indefinitely until the SecureChannel times out, leading to memory exhaustion. The attack requires no authentication, no active session, and bypasses all encryption configurations. Affected versions include open62541 1.4.0 through 1.4.16, 1.5.0 through 1.5.4, and the master branch. A fix is available via a pull request on the official GitHub repository.