CVE-2022-21208

CVE-2022-21208 affects the NodeOPCUA library. The vulnerability is a DoS caused by a missing limit on the number of received chunks per session or across all concurrent sessions, allowing an attacker to send an unlimited number of huge chunks (e.g., 2 GB each) without the Final closing chunk. Aff...

CVE-2022-21208 Denial of Service (DoS)

The package node-opcua before 2.74.0 are vulnerable to Denial of Service DoS due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited number of huge chunks e.g. 2GB...

CVE-2022-25231 Denial of Service (DoS)

The package node-opcua before 2.74.0 are vulnerable to Denial of Service DoS by sending a specifically crafted OPC UA message with a special OPC UA NodeID, when the requested memory allocation exceeds the v8’s memory limit...

CVE-2022-25231

CVE-2022-25231 affects node-opcua before 2.74.0. A crafted OPC UA message with a specific NodeID can trigger memory-allocation-induced DoS when v8 memory limits are exceeded, impacting availability. Mitigation: upgrade to node-opcua 2.74.0 or later (remediation consistently recommended across OSV...

CVE-2022-25304

CVE-2022-25304 affects all versions of the Python OPC-UA stack OPC-UA and asyncua. The root cause is a missing limit on the number of received chunks per session and across concurrent sessions, enabling a Denial of Service by an attacker sending unlimited large chunks (e.g., 2GB) without a final ...

CVE-2022-25304 Denial of Service (DoS)

All versions of package opcua; all versions of package asyncua are vulnerable to Denial of Service DoS due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited numb...

CVE-2022-25304

Removed by vendor...

CVE-2022-25231

The package node-opcua before 2.74.0 are vulnerable to Denial of Service DoS by sending a specifically crafted OPC UA message with a special OPC UA NodeID, when the requested memory allocation exceeds the v8’s memory limit...

CVE-2022-21208

The package node-opcua before 2.74.0 are vulnerable to Denial of Service DoS due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited number of huge chunks e.g. 2GB...

CVE-2022-25888

The package opcua from 0.0.0 are vulnerable to Denial of Service DoS due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited number of huge chunks e.g. 2GB each...

PT-2022-4448

Name of the Vulnerable Software and Affected Versions opcua versions all asyncua versions all Description The issue is related to an uncontrolled consumption of resources in the opcua and asyncua libraries. This can be exploited by a remote attacker to cause a denial of service. The vulnerability...

python-opcua 安全漏洞

python-opcua is an LGPL pure Python OPC-UA client and server from the Free OPC-UA Library open source. A security vulnerability exists in python-opcua that stems from the lack of a limit on the number of blocks received per session or total number of all concurrent sessions...

Denial of Service (DoS)

Overview opcua is an OPC UA server / client API implementation for Rust. Affected versions of this package are vulnerable to Denial of Service DoS via the ExtensionObjects and Variants objects, when it allows unlimited nesting levels, which could result in a stack overflow even if the message siz...

aristote-malo (1.9.5), biobridge (>=0.1.0, <=0.2.5) +29 more potentially affected by CVE-2022-25304 via opcua (>=0.98.3, <=0.98.13)

opcua PYPI version =0.98.3, =0.1.0, =5.1.0, =1.4.1b1, =0.7.0b1, =0.3.3, =1.0.1, =0.1.5, =0.1.7 and more Source cves: CVE-2022-25304 Source advisory: SNYK:PYTHON-OPCUA-2988730...

@frangoteam/fuxa (>=1.1.7, <=1.1.8), @hive-command/discovery-server (>=1.3.2-alpha.86, <=1.3.3-alpha.35) +19 more potentially affected by CVE-2022-24375 via node-opcua (>=2.1.9, <=2.73.1)

node-opcua NPM version =2.1.9, =1.1.7, =1.3.2-alpha.86, =1.3.6-alpha.36, =1.3.5, =0.0.3, =0.0.3, =0.0.2, =1.3.0-alpha.0, =0.8.0, =2.10.0, =2.10.0, =4.0.0, =1.0.0, =0.2.93, =0.2.286 and more Source cves: CVE-2022-24375 Source advisory: SNYK:JS-NODEOPCUA-2988725...

Denial of Service (DoS)

Overview node-opcua is an implementation of a OPC UA stack fully written in javascript and nodejs Affected versions of this package are vulnerable to Denial of Service DoS when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the...

@frangoteam/fuxa (>=1.1.7, <=1.1.8), @hive-command/discovery-server (>=1.3.2-alpha.86, <=1.3.3-alpha.35) +19 more potentially affected by CVE-2022-25231 via node-opcua (>=2.1.9, <=2.73.1)

node-opcua NPM version =2.1.9, =1.1.7, =1.3.2-alpha.86, =1.3.6-alpha.36, =1.3.5, =0.0.3, =0.0.3, =0.0.2, =1.3.0-alpha.0, =0.8.0, =2.10.0, =2.10.0, =4.0.0, =1.0.0, =0.2.93, =0.2.286 and more Source cves: CVE-2022-25231 Source advisory: SNYK:JS-NODEOPCUA-2988724...

Denial of Service (DoS)

Overview node-opcua is an implementation of a OPC UA stack fully written in javascript and nodejs Affected versions of this package are vulnerable to Denial of Service DoS by sending a specifically crafted OPC UA message with a special OPC UA NodeID, when the requested memory allocation exceeds t...

@frangoteam/fuxa (>=1.1.7, <=1.1.8), @hive-command/discovery-server (>=1.3.2-alpha.86, <=1.3.3-alpha.35) +19 more potentially affected by CVE-2022-21208 via node-opcua (>=2.1.9, <=2.73.1)

node-opcua NPM version =2.1.9, =1.1.7, =1.3.2-alpha.86, =1.3.6-alpha.36, =1.3.5, =0.0.3, =0.0.3, =0.0.2, =1.3.0-alpha.0, =0.8.0, =2.10.0, =2.10.0, =4.0.0, =1.0.0, =0.2.93, =0.2.286 and more Source cves: CVE-2022-21208 Source advisory: SNYK:JS-NODEOPCUA-2988723...

Denial of Service (DoS)

Overview node-opcua is an implementation of a OPC UA stack fully written in javascript and nodejs Affected versions of this package are vulnerable to Denial of Service DoS due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An...