CVE-2022-25903

The package opcua from 0.0.0 are vulnerable to Denial of Service DoS via the ExtensionObjects and Variants objects, when it allows unlimited nesting levels, which could result in a stack overflow even if the message size is less than the maximum allowed...

CVE-2022-24375

The package node-opcua before 2.74.0 are vulnerable to Denial of Service DoS when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False...

Stack overflow

The package opcua from 0.0.0 are vulnerable to Denial of Service DoS via the ExtensionObjects and Variants objects, when it allows unlimited nesting levels, which could result in a stack overflow even if the message size is less than the maximum allowed...

CVE-2022-24375

The CVE-2022-24375, observed in the node-opcua package, is a DoS vulnerability that occurs when an attacker bypasses memory-consumption limits by sending multiple CloseSession requests with deleteSubscription set to False. Affected are versions prior to 2.74.0. The root cause is improper resource...

CVE-2022-24375 Denial of Service (DoS)

The package node-opcua before 2.74.0 are vulnerable to Denial of Service DoS when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False...

CVE-2022-24375 Denial of Service (DoS)

The package node-opcua before 2.74.0 are vulnerable to Denial of Service DoS when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False...

CVE-2022-25903

Summary of CVE-2022-25903 / OPC UA Rust crate : A DoS via unlimited nesting in ExtensionObjects and Variants, leading to a stack overflow even when message size is below the limit. Affected versions are 0.0.0 through 0.11.0. Remediation: upgrade to 0.11.0 or higher (as cited by Snyk/OPC UA mainta...

CVE-2022-25903 Denial of Service (DoS)

The package opcua from 0.0.0 are vulnerable to Denial of Service DoS via the ExtensionObjects and Variants objects, when it allows unlimited nesting levels, which could result in a stack overflow even if the message size is less than the maximum allowed...

CVE-2022-24375

The package node-opcua before 2.74.0 are vulnerable to Denial of Service DoS when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False...

CVE-2022-25903

The package opcua from 0.0.0 are vulnerable to Denial of Service DoS via the ExtensionObjects and Variants objects, when it allows unlimited nesting levels, which could result in a stack overflow even if the message size is less than the maximum allowed...

@frangoteam/fuxa (>=1.1.7, <=1.1.8), @hive-command/discovery-server (>=1.3.2-alpha.86, <=1.3.3-alpha.35) +19 more potentially affected by CVE-2022-21208 via node-opcua (>=2.1.9, <=2.73.1)

node-opcua NPM version =2.1.9, =1.1.7, =1.3.2-alpha.86, =1.3.6-alpha.36, =1.3.5, =0.0.3, =0.0.3, =0.0.2, =1.3.0-alpha.0, =0.8.0, =2.10.0, =2.10.0, =4.0.0, =1.0.0, =0.2.93, =0.2.286 and more Source cves: CVE-2022-21208 Source advisory: OSV:GHSA-4HR4-PJJH-2Q2W...

node-opcua DoS vulnerability via message with memory allocation that exceeds v8's memory limit

The package node-opcua before 2.74.0 are vulnerable to Denial of Service DoS by sending a specifically crafted OPC UA message with a special OPC UA NodeID, when the requested memory allocation exceeds the v8’s memory limit...

@frangoteam/fuxa (>=1.1.7, <=1.1.8), @hive-command/discovery-server (>=1.3.2-alpha.86, <=1.3.3-alpha.35) +19 more potentially affected by CVE-2022-25231 via node-opcua (>=2.1.9, <=2.73.1)

node-opcua NPM version =2.1.9, =1.1.7, =1.3.2-alpha.86, =1.3.6-alpha.36, =1.3.5, =0.0.3, =0.0.3, =0.0.2, =1.3.0-alpha.0, =0.8.0, =2.10.0, =2.10.0, =4.0.0, =1.0.0, =0.2.93, =0.2.286 and more Source cves: CVE-2022-25231 Source advisory: OSV:GHSA-QPGC-XH7J-52Q8...

GHSA-MFPJ-3QHM-976M Uncontrolled Resource Consumption in asyncua and opcua

All versions of package opcua; all versions of package asyncua are vulnerable to Denial of Service DoS due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited numb...

GHSA-4HR4-PJJH-2Q2W Uncontrolled Resource Consumption in node-opcua

The package node-opcua before 2.74.0 are vulnerable to Denial of Service DoS due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited number of huge chunks e.g. 2GB...

Uncontrolled Resource Consumption in opcua

The package opcua from 0.0.0 are vulnerable to Denial of Service DoS due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited number of huge chunks e.g. 2GB each...

Uncontrolled Resource Consumption in asyncua and opcua

All versions of package opcua; all versions of package asyncua are vulnerable to Denial of Service DoS due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited numb...

GHSA-8MX2-GQX9-RM7F Uncontrolled Resource Consumption in opcua

The package opcua from 0.0.0 are vulnerable to Denial of Service DoS due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited number of huge chunks e.g. 2GB each...

opcua 缓冲区错误漏洞

opcua is a client and server implementation of the OPC UA specification written in Rust. A buffer error vulnerability exists in opcua version 0.0.0 and later. An attacker could use this vulnerability to perform a denial of service DoS attack via the ExtensionObjects and Variants objects...

PT-2022-17596 · Opcua · Opcua

Name of the Vulnerable Software and Affected Versions: opcua versions 0.0.0 through 0.11.0 Description: The issue allows for Denial of Service DoS via the ExtensionObjects and Variants objects. This occurs because the package allows unlimited nesting levels, which could result in a stack overflow...