CVE-2022-25761: Denial of Service (DoS)
The package open62541/open62541 before 1.2.5, from 1.3-rc1 and before 1.3.1 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited number of huge chunks (e.g. 2GB each) without sending the Final closing chunk.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2022-25761?
CVE-2022-25761 has a high severity rating due to its potential to cause a Denial of Service (DoS) by overwhelming a server.
How do I fix CVE-2022-25761?
To fix CVE-2022-25761, update to open62541 version 1.2.5 or later.
Which versions of open62541 are affected by CVE-2022-25761?
CVE-2022-25761 affects open62541 versions prior to 1.2.5, and also includes 1.3-rc1 and 1.3-rc2.
What type of vulnerability is CVE-2022-25761?
CVE-2022-25761 is a Denial of Service (DoS) vulnerability resulting from a lack of limits on received data chunks.
Can CVE-2022-25761 be exploited remotely?
Yes, CVE-2022-25761 can be exploited remotely by attackers to disrupt service.