CVE-2026-61387: Eclipse Milo Eclipse Milo vulnerability
In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server-global reservation is not restored. Deeply nested PubSub ExtensionObjects in a CreateMonitoredItems event filter can trigger a StackOverflowError during decoding, allowing an unauthenticated remote client to exhaust a finite global monitored-item quota and prevent all clients from creating new monitored items until restart. Existing monitored items and other server functions remain unaffected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
To prevent unauthenticated remote clients from exhausting the finite global monitored-item quota, restrict network access to the OPC UA server endpoints (e.g., firewall/ACL allow only authenticated/trusted clients) until all servers are upgraded.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-61387?
The severity of CVE-2026-61387 is rated at 45.
How can I fix CVE-2026-61387?
To fix CVE-2026-61387, update Eclipse Milo to a version higher than 1.1.4 where the issue is addressed.
What versions of Eclipse Milo are affected by CVE-2026-61387?
Eclipse Milo versions from 1.0.0 to 1.1.4 are affected by CVE-2026-61387.
What vulnerability does CVE-2026-61387 address?
CVE-2026-61387 addresses the lack of exception safety in monitored-item quota accounting during item creation.
What could be a potential consequence of CVE-2026-61387?
A potential consequence of CVE-2026-61387 is that unchecked errors during item creation may prevent the server-global reservation from being restored.