CVE-2026-61387
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server-global reservation is not restored. Deeply nested PubSub ExtensionObjects in a CreateMonitoredItems event filter can trigger a StackOverflowError during decoding, allowing an unauthenticated remote client to exhaust a finite global monitored-item quota and prevent all clients from creating new monitored items until restart. Existing monitored items and other server functions remain unaffected.
Risk Assessment
An attacker can block the creation of new monitored items for all clients, potentially leading to reduced system functionality and monitoring disruptions.
Recommendation
Upgrade Eclipse Milo to a patched version and consider restricting access to the server for unauthenticated clients.
Other vulnerabilities in Eclipse Milo
See all- CVE-2026-63252High
Eclipse Milo versions 0.6.0 through 1.1.4 have a vulnerability where UASC server transport handlers fail to release retained partial message chunks on disconnect, allowing a remote unauthenticated client to exhaust pooled direct memory and potentially terminate the server.
- CVE-2026-63248Medium
In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization. An anonymous client can enable diagnostics over a None/None endpoint without a certificate; with a trusted client application certificate over SignAndEncrypt, it can read security diagnostics for other active sessions, exposing usernames, login history, authentication mechanisms, security modes and policies, and public client certificates.
- CVE-2026-62927High
Eclipse Milo versions 1.0.0 through 1.1.4 have a vulnerability in the Call service that dispatches the original mixed batch to address-space handlers after calculating authorization, allowing an anonymous or low-privileged client to execute a denied method by batching it with an allowed method.
- CVE-2026-60007High
In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures. This allows an on-path attacker who captures a victim's Basic128Rsa15-encrypted username token to use repeated unauthenticated ActivateSession requests as a padding oracle, recover the victim's password, and authenticate with the recovered credentials.
- CVE-2026-58080High
Eclipse Milo versions 1.0.0 through 1.1.4 have a vulnerability where OpcUaServerConfig.copy() fails to preserve a configured RoleMapper, leading to skipped role-permission checks and allowing an anonymous client to access protected data and operations.
Original NVD description (English source)
In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server-global reservation is not restored. Deeply nested PubSub ExtensionObjects in a `CreateMonitoredItems` event filter can trigger a `StackOverflowError` during decoding, allowing an unauthenticated remote client to exhaust a finite global monitored-item quota and prevent all clients from creating new monitored items until restart. Existing monitored items and other server functions remain unaffected.