CVE-2026-63248

Eclipse Milo versions 0.6.0 through 1.1.4 have a vulnerability where UASC server transport handlers fail to release retained partial message chunks on disconnect, allowing a remote unauthenticated client to exhaust pooled direct memory and potentially terminate the server.

Eclipse Milo versions 1.0.0 through 1.1.4 have a vulnerability in the Call service that dispatches the original mixed batch to address-space handlers after calculating authorization, allowing an anonymous or low-privileged client to execute a denied method by batching it with an allowed method.

In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server-global reservation is not restored. Deeply nested PubSub ExtensionObjects in a CreateMonitoredItems event filter can trigger a StackOverflowError during decoding, allowing an unauthenticated remote client to exhaust a finite global monitored-item quota and prevent all clients from creating new monitored items until restart. Existing monitored items and other server functions remain unaffected.

In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures. This allows an on-path attacker who captures a victim's Basic128Rsa15-encrypted username token to use repeated unauthenticated ActivateSession requests as a padding oracle, recover the victim's password, and authenticate with the recovered credentials.

Eclipse Milo versions 1.0.0 through 1.1.4 have a vulnerability where OpcUaServerConfig.copy() fails to preserve a configured RoleMapper, leading to skipped role-permission checks and allowing an anonymous client to access protected data and operations.