CVE-2026-67855
7.5 HIGHpublic exploit availablePublished 2026-08-04 · Updated 2026-08-05
AI risk analysis
- Summary
- The flaw in open62541 allows a remote attacker to cause a denial of service through heap use-after-free in GDS PushManagement certificate update when UA_ENABLE_GDS_PUSHMANAGEMENT is enabled.
- Exploitability
- Exploitation requires enabling UA_ENABLE_GDS_PUSHMANAGEMENT and could be moderately difficult due to the need for precise timing and control over certificate updates.
- Blast radius
- If exploited, this could lead to a denial of service affecting the system's availability.
- Prioritized remediation
- Disable UA_ENABLE_GDS_PUSHMANAGEMENT or update open62541 to a patched version.
dosremoteics
Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
open62541 contains a heap use-after-free in the GDS PushManagement certificate update workflow when UA_ENABLE_GDS_PUSHMANAGEMENT is enabled. This allows a remote attacker to cause a denial of service.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Public exploit & PoC references
- https://github.com/open62541/open62541
- https://github.com/open62541/open62541/blob/master/arch/posix/eventloop_posix.c
- https://github.com/open62541/open62541/blob/master/examples/encryption/server_encryption.c
- https://github.com/open62541/open62541/blob/master/src/server/ua_server_internal.h
- https://github.com/open62541/open62541/blob/master/src/server/ua_server_ns0_gds.c
- https://github.com/open62541/open62541/issues/8093
- https://github.com/open62541/open62541/issues/8093
All references
- https://github.com/open62541/open62541
- https://github.com/open62541/open62541/blob/master/arch/posix/eventloop_posix.c
- https://github.com/open62541/open62541/blob/master/examples/encryption/server_encryption.c
- https://github.com/open62541/open62541/blob/master/src/server/ua_server_internal.h
- https://github.com/open62541/open62541/blob/master/src/server/ua_server_ns0_gds.c
- https://github.com/open62541/open62541/issues/8093
- https://github.com/open62541/open62541/issues/8093
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.