CVE-2026-61387

In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server-global reservation is not restored. Deeply nested PubSub ExtensionObjects in a CreateMonitoredItems event filter can trigger a...

CVE-2026-61387

In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server-global reservation is not restored. Deeply nested PubSub ExtensionObjects in a CreateMonitoredItems event filter can trigger a...

CVE-2026-62927: Incorrect Authorization

In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization, allowing an anonymous or otherwise low-privileged client to execute a denied method by batching it with an allowed method...

PT-2026-67697

Name of the Vulnerable Software and Affected Versions Eclipse Milo versions 1.0.0 through 1.1.4 Description Monitored-item quota accounting is not exception-safe, meaning that if item creation fails due to an unchecked error, the server-global reservation is not restored. An unauthenticated remot...

CVE-2026-60007: Observable Response Discrepancy

In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim's Basic128Rsa15-encrypted username token to use repeated unauthenticated...

CVE-2026-58080: Missing Authorization

In Eclipse Milo versions 1.0.0 through 1.1.4, OpcUaServerConfig.copy fails to preserve a configured RoleMapper. On servers that rely on role permissions and construct the running configuration through copy, sessions receive no role IDs and the default access controller skips role-permission check...

PT-2026-67700

Name of the Vulnerable Software and Affected Versions Eclipse Milo versions 0.6.0 through 1.1.4 Description UASC server transport handlers do not release retained partial message chunks upon channel disconnection. This allows a remote unauthenticated client to exhaust pooled direct memory by...

PT-2026-67699

Name of the Vulnerable Software and Affected Versions Eclipse Milo versions 0.6.0 through 1.1.4 Description OPC UA server diagnostics nodes fail to enforce access authorization. This allows an anonymous client to enable diagnostics via a None/None endpoint without a certificate. Additionally, a...

CVE-2026-61387: Improper Cleanup on Thrown Exception

In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server-global reservation is not restored. Deeply nested PubSub ExtensionObjects in a CreateMonitoredItems event filter can trigger a...

CVE-2026-63248: Missing Authorization

In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization. An anonymous client can enable diagnostics over a None/None endpoint without a certificate; with a trusted client application certificate over SignAndEncrypt, it can read security...

CVE-2026-63252: Missing Release of Memory after Effective Lifetime

In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message chunks when a channel disconnects, allowing a remote unauthenticated client to exhaust pooled direct memory by repeatedly sending incomplete chunks and disconnecting, potentially...

PT-2026-67698

Name of the Vulnerable Software and Affected Versions Eclipse Milo versions 1.0.0 through 1.1.4 Description The Call service dispatches the original mixed batch to address-space handlers after calculating authorization. This allows an anonymous or low-privileged client to execute a denied method ...

PT-2026-67695

Name of the Vulnerable Software and Affected Versions Eclipse Milo versions 1.0.0 through 1.1.4 Description The OpcUaServerConfig.copy function fails to preserve a configured RoleMapper. On servers that rely on role permissions and construct the running configuration using copy, sessions are not...

PT-2026-67696

Name of the Vulnerable Software and Affected Versions Eclipse Milo versions 0.6.0 through 1.1.4 Description Username-token processing returns distinguishable errors for invalid RSA PKCS1 v1.5 padding and other authentication failures. This allows an on-path attacker who captures a victim's...

EUVD-2022-6805

Malicious code in bioql PyPI...

sdk-server: Denial of Service

A flaw was found in the Eclipse Milo SDK Server. This flaw allows an attacker to consume the application memory, leading to a denial of service by sending specific requests...

CVE-2022-25897

A flaw was found in the Eclipse Milo SDK Server. This flaw allows an attacker to consume the application memory, leading to a denial of service by sending specific requests...

CVE-2022-25897

The package org.eclipse.milo:sdk-server before 0.6.8 are vulnerable to Denial of Service DoS when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False...

Eclipse Milo 安全漏洞

Eclipse Milo is an open source implementation of OPC UA IEC 62541 from the Eclipse Foundation. A security vulnerability exists in Eclipse Milo sdk-server versions prior to 0.6.8, which originates from a denial of service when the memory footprint limit is bypassed by sending multiple CloseSession...

PT-2022-17593 · Eclipse · Org.Eclipse.Milo:Sdk-Server

Name of the Vulnerable Software and Affected Versions: org.eclipse.milo:sdk-server versions prior to 0.6.8 Description: The issue allows for a Denial of Service DoS when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscriptio...