HIGH

CVE-2026-67855

2026-08-04 CVSS v3.1

CVSS

7.5

Description

open62541 contains a heap use-after-free in the GDS PushManagement certificate update workflow when UA_ENABLE_GDS_PUSHMANAGEMENT is enabled. This allows a remote attacker to cause a denial of service.

Weakness (CWE)

CWE-400 Uncontrolled Resource Consumption

EPSS Score

0.29%

Probability of exploitation in next 30 days

21.4th percentile

References

https://github.com/open62541/open62541 https://github.com/open62541/open62541/blob/master/arch/posix/eventloop_posix.c https://github.com/open62541/open62541/blob/master/examples/encryption/server_encryption.c https://github.com/open62541/open62541/blob/master/src/server/ua_server_internal.h https://github.com/open62541/open62541/blob/master/src/server/ua_server_ns0_gds.c https://github.com/open62541/open62541/issues/8093

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE