95 matches found
CVE-2026-58080
In Eclipse Milo versions 1.0.0 through 1.1.4, OpcUaServerConfig.copy fails to preserve a configured RoleMapper. On servers that rely on role permissions and construct the running configuration through copy, sessions receive no role IDs and the default access controller skips role-permission check...
CVE-2026-63252
In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message chunks when a channel disconnects, allowing a remote unauthenticated client to exhaust pooled direct memory by repeatedly sending incomplete chunks and disconnecting, potentially...
EUVD-2026-52662
In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message chunks when a channel disconnects, allowing a remote unauthenticated client to exhaust pooled direct memory by repeatedly sending incomplete chunks and disconnecting, potentially...
com.digitalpetri.opcua:uanodeset-namespace (>=0.3, <=0.4.1), io.github.rakovpublic.jneopallium:bridge-opcua (1.0.0) +21 more potentially affected by CVE-2026-63252 via org.eclipse.milo:milo-transport (>=1.0.0, <=1.1.4)
org.eclipse.milo:milo-transport MAVEN version =1.0.0, =0.3, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.4.4, =4.18.1, =3.31.0, =3.31.0, =3.31.0, =3.38.0 and more Source cves: CVE-2026-63252 Source advisory: MEND:CVE-2026-63252...
com.digitalpetri.byteops:byteops-milo (0.2.1), com.digitalpetri.opcua:uanodeset-core (>=0.3, <=0.4.1) +28 more potentially affected by CVE-2026-63252 via org.eclipse.milo:milo-stack-core (>=1.0.0, <=1.1.4)
org.eclipse.milo:milo-stack-core MAVEN version =1.0.0, =0.3, =0.3, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.4.4, =4.18.1, =3.31.0, =3.38.0 and more Source cves: CVE-2026-63252 Source advisory: MEND:CVE-2026-63252...
CVE-2026-63252
In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message chunks when a channel disconnects, allowing a remote unauthenticated client to exhaust pooled direct memory by repeatedly sending incomplete chunks and disconnecting, potentially...
CVE-2026-63252
In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message chunks when a channel disconnects, allowing a remote unauthenticated client to exhaust pooled direct memory by repeatedly sending incomplete chunks and disconnecting, potentially...
CVE-2026-63252
Technical details for CVE-2026-63252 are not publicly available in the provided documents. Monitor for updates from Eclipse Milo project and associated security advisories to obtain affected versions, impact, and remediation guidance.
CVE-2026-63252
In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message chunks when a channel disconnects, allowing a remote unauthenticated client to exhaust pooled direct memory by repeatedly sending incomplete chunks and disconnecting, potentially...
CVE-2026-62927
In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization, allowing an anonymous or otherwise low-privileged client to execute a denied method by batching it with an allowed method...
EUVD-2026-52661
In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization, allowing an anonymous or otherwise low-privileged client to execute a denied method by batching it with an allowed method...
com.digitalpetri.opcua:uanodeset-namespace (>=0.3, <=0.4.1), net.rossonet.waldot:waldot-client (0.6.1) +15 more potentially affected by CVE-2026-62927 via org.eclipse.milo:milo-sdk-server (>=1.0.0, <=1.1.4)
org.eclipse.milo:milo-sdk-server MAVEN version =1.0.0, =0.3, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.4.4, =4.18.1, =3.31.0, =3.31.0, =3.31.0, =4.16.0, =4.16.0, =1.0.1, =1.1.4 and more Source cves: CVE-2026-62927 Source advisory: MEND:CVE-2026-62927...
CVE-2026-62927
In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization, allowing an anonymous or otherwise low-privileged client to execute a denied method by batching it with an allowed method...
CVE-2026-62927
In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization, allowing an anonymous or otherwise low-privileged client to execute a denied method by batching it with an allowed method...
CVE-2026-62927
In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization, allowing an anonymous or otherwise low-privileged client to execute a denied method by batching it with an allowed method...
CVE-2026-62927
Technical details for CVE-2026-62927 are not available in the provided connected documents; monitor for updates.
com.digitalpetri.opcua:uanodeset-namespace (>=0.3, <=0.4.1), net.rossonet.waldot:waldot-client (0.6.1) +15 more potentially affected by CVE-2026-60007 via org.eclipse.milo:milo-sdk-server (>=1.0.0, <=1.1.4)
org.eclipse.milo:milo-sdk-server MAVEN version =1.0.0, =0.3, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.4.4, =4.18.1, =3.31.0, =3.31.0, =3.31.0, =4.16.0, =4.16.0, =1.0.1, =1.1.4 and more Source cves: CVE-2026-60007 Source advisory: MEND:CVE-2026-60007...
EUVD-2026-52660
In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim's Basic128Rsa15-encrypted username token to use repeated unauthenticated...
CVE-2026-60007
In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim's Basic128Rsa15-encrypted username token to use repeated unauthenticated...
CVE-2026-60007
In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim's Basic128Rsa15-encrypted username token to use repeated unauthenticated...