CVE-2022-25897

The CVE-2022-25897 issue affects the Eclipse Milo SDK-Server (org.eclipse.milo:sdk-server) prior to version 0.6.8. The root cause is a memory‑consumption bypass in CloseSession handling when deleteSubscription is False, allowing a denial of service via repeated CloseSession requests. The Red Hat ...

CVE-2026-60007

CVE-2026-60007 affects Eclipse Milo versions 0.6.0 through 1.1.4, where username-token processing reveals distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures. This enables a network-accessible, on-path attacker who captures a victim’s Basic128Rsa15-encrypt...

CVE-2026-61387

CVE-2026-61387 (Eclipse Milo) affects Milo 1.0.0–1.1.4. The issue is that monitored-item quota accounting is not exception-safe: if item creation fails due to an unchecked error, the server-global reservation is not restored. Additionally, deeply nested PubSub ExtensionObjects in a CreateMonitore...

CVE-2026-63248

CVE-2026-63248 affects Eclipse Milo OPC UA server diagnostics nodes (versions 0.6.0–1.1.4). The diagnostics endpoint fails to enforce access authorization, allowing anonymous access over a None/None endpoint without a certificate, and enabling a trusted client with SignAndEncrypt to read security...

CVE-2026-62927

Technical details for CVE-2026-62927 are not available in the provided connected documents; monitor for updates.

CVE-2026-58080

Eclipse Milo 1.0.0–1.1.4 contains a bug in OpcUaServerConfig.copy() that fails to preserve a configured RoleMapper. On servers building running config via copy(), sessions may have no role IDs, causing the default access controller to skip role-permission checks. This enables an anonymous client ...

CVE-2026-63252

Technical details for CVE-2026-63252 are not publicly available in the provided documents. Monitor for updates from Eclipse Milo project and associated security advisories to obtain affected versions, impact, and remediation guidance.