open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions.
CVSS 4.0CRITICAL 9.2·Network·No auth·No interaction·EPSS 0.00432·Published 2026-10-24·Fixed in 1.5.7CWE-190
The package open62541/open62541 before 1.2.5, from 1.3-rc1 and before 1.3.1 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all…
CVSS 3.1HIGH 7.5·Network·No auth·No interaction·EPSS 0.01445·Published 2022-08-23·Fixed in 1.2.5, 1.3.1CWE-770