Hi,

The following vulnerabilities were published for open62541.

CVE-2026-11946[0]:
| An unauthenticated remote attacker can exhaust server memory via the
| GetEndpoints Discovery Service in open62541. The endpointUrl field
| of GetEndpointsRequest is not validated for length. An attacker can
| declare an arbitrarily large string (up to ~4.09 GB via the UInt32
| length field) delivered across intermediate chunks without ever
| sending the final chunk. The server buffers all chunks in RAM
| indefinitely until the SecureChannel times out. The attack is pre-
| session and bypasses all encryption configurations.    The issue
| affects open62541: from 1.4.0 through 1.4.16, from 1.5.0 through
| 1.5.4, master.


CVE-2026-33592[1]:
| An unauthenticated remote attacker can exhaust server memory via the
| FindServers Discovery Service in open62541. The serverUris field of
| FindServersRequest is not validated for length or array size. An
| attacker can declare an arbitrarily large string (up to ~3.9 GB)
| delivered across intermediate chunks without ever sending the final
| chunk. The server buffers all chunks in RAM indefinitely until the
| SecureChannel times out. The attack is pre-session and bypasses all
| encryption configuration. The issue affects open62541: from 1.4.0
| through 1.4.16, from 1.5.0 through 1.5.4, master.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-11946
https://www.cve.org/CVERecord?id=CVE-2026-11946
[1] https://security-tracker.debian.org/tracker/CVE-2026-33592
https://www.cve.org/CVERecord?id=CVE-2026-33592
[2] https://github.com/open62541/open62541/pull/8142
[3] https://github.com/open62541/open62541/commit/c9563e8ea4a8db2f64059c8ff7efe0b49a35bea3

Regards,
Salvatore