Hi,

The following vulnerability was published for open62541.

CVE-2026-15690[0]:
| A vulnerability was identified in open62541 up to 1.5.5. Affected by
| this issue is the function responseReadNamespacesArray of the file
| src/client/ua_client_connect.c of the component Shared Client
| Library. Such manipulation of the argument Server_NamespaceArray
| leads to null pointer dereference. The attack can be executed
| remotely. The attack requires a high level of complexity. The
| exploitation is known to be difficult. The exploit is publicly
| available and might be used. The project closed the issue report,
| stating that this is not the official way to report a security
| vulnerability.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-15690
https://www.cve.org/CVERecord?id=CVE-2026-15690
[1] https://github.com/open62541/open62541/issues/8104

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Hi,

The fixed upstream maintenance release v1.4.18 is waiting to be released as
a package update.
The Salsa repository is ready: https://salsa.debian.org/jpfr/open62541

Thank you for verifying and pulling the trigger.

Regards,
Julius

Hi,

The fixed upstream maintenance release v1.4.18 is waiting to be released as
a package update.
The Salsa repository is ready: https://salsa.debian.org/jpfr/open62541

Thank you for verifying and pulling the trigger.

Regards,
Julius

Julias,

I would recommend you add “pristine-tar=true” to debian/gbp.conf.  This will
create a pristine-tar branch when running “gbp import-orig --uscan” and “gbp
push”.  Pristine-tar is nice because it makes sure that everyone is using the
same upstream tarball when building the package.  See, for example:

https://salsa.debian.org/cryptocoin-team/electrum/-/blob/master/debian/
gbp.conf?ref_type=heads#L2

There are also a number of lintian tags that should be easy to address.

open62541 source: testsuite-depends-on-obsolete-package Depends: pkg-config
(>= 0.29.2) => pkgconf
N:
N:   The testsuite depends on a package that has been superseded. If the
superseded package is part of an ORed group, it should not be the first
package in the group.
N:
N:   Visibility: warning
N:   Show-Always: no
N:   Check: testsuite
N:
N:
I: open62541 source: older-debian-watch-file-standard 4 [debian/watch]
N:
N:   The version= line in the debian/watch file in this package declares an
older version. Please upgrade when you have a chance.
N:
N:   Please refer to the uscan(1) manual page for details.
N:
N:   Visibility: info
N:   Show-Always: no
N:   Check: debian/watch/standard
N:
N:
P: open62541 source: package-uses-old-debhelper-compat-version 13
N:
N:   This package uses a debhelper compatibility level that is no longer
recommended. Please consider using the recommended level.
N:
N:   For most packages, the best way to set the compatibility level is to
specify debhelper-compat (= X) as a Build-Depends in debian/control. You can
also use the debian/compat file or export DH_COMPAT in debian/rules.
N:
N:   If no level is selected debhelper defaults to level 1, which is
deprecated.
N:
N:   Please refer to the debhelper(7) manual page for details.
N:
N:   Visibility: pedantic
N:   Show-Always: no
N:   Check: debhelper
N:
N:
P: open62541 source: redundant-rules-requires-root-no-field [debian/control:4]
N:
N:   This package currently sets the Rules-Requires-Root field in the debian/
control file to "no".
N:
N:   As of dpkg version 1.22.13, this field is set to "no" by default. As
such, in this case the Rules-Requires-Root field is redundant and should be
removed.
N:
N:   Visibility: pedantic
N:   Show-Always: no
N:   Check: debian/control/field/rules-requires-root

All done:
https://salsa.debian.org/jpfr/open62541/-/commit/17fc547ebcf92b5c4582ab10ae7d2a73cebaef87
The pipeline is green also.