CVE-2022-25761: The package open62541/open62541 before 1.2.5, from 1.3-rc1 and before 1.3.1 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number…

PriorityP337high7.5CVSS 3.1

AVNACLPRNUINSUCNINAH

EPSS

1.13%

62.7th percentile

The package open62541/open62541 before 1.2.5, from 1.3-rc1 and before 1.3.1 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited number of huge chunks (e.g. 2GB each) without sending the Final closing chunk.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
debian	open62541	—	—
fedoraproject	fedora	—	—
open62541	open62541	< 1.2.5	1.2.5
open62541	open62541	—	—
open62541	open62541	>= 1.3-rc1 < unspecified	unspecified
open62541	open62541	>= unspecified < 1.2.5	1.2.5
open62541	open62541	>= unspecified < 1.3.1	1.3.1

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vendor_debian7.5LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.