CVE-2026-63362

Description

A flaw was found in open62541. An unsigned integer underflow in the PubSub signature verification path may allow a remote attacker to cause a denial of service by sending a specially crafted User Datagram Protocol (UDP) packet. This vulnerability could make the affected system unavailable to legitimate users.

Statement

This Moderate severity flaw in open62541 can lead to a denial of service. A remote attacker could exploit an unsigned integer underflow in the PubSub signature verification path by sending a specially crafted UDP packet. The high attack complexity associated with this vulnerability reduces the likelihood of successful exploitation. This component is only present in Fedora. Red Hat does not ship this component in any core Red Hat products.

Mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Fedora ships version 1.5.6 which already includes the fix.

Understanding the Weakness (CWE)

CWE-191

Availability

Technical Impact: DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Instability

This weakness will generally lead to undefined behavior and therefore crashes. In the case of overflows involving loop index variables, the likelihood of infinite loops is also high.

Integrity

Technical Impact: Modify Memory

If the value in question is important to data (as opposed to flow), simple data corruption has occurred. Also, if the wrap around results in other conditions such as buffer overflows, further memory corruption may occur.

Confidentiality,Availability,Access Control

Technical Impact: Execute Unauthorized Code or Commands; Bypass Protection Mechanism

This weakness can sometimes trigger buffer overflows which can be used to execute arbitrary code. This is usually outside the scope of a program's implicit security policy.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.