Advisory severityHigh7.5Red Hat Linux

High [CVE-2026-11946] Denial of Service via unvalidated endpoint URL length

This high-severity Red Hat Linux advisory covers CVE-2026-11946.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-11946 Source published Jul 2, 2026Source updated Jul 2, 2026

VulniPulse record published Jul 9, 2026Record updated Jul 13, 2026

CVE-2026-11946

Affected products & platforms

Red Hat LinuxUnclassified

Open source advisory

Android app · Google Play

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

An unauthenticated remote attacker can exhaust server memory via the GetEndpoints Discovery Service in open62541. The endpointUrl field of GetEndpointsRequest is not validated for length.

An attacker can declare an arbitrarily large string (up to ~4.09 GB via the UInt32 length field) delivered across intermediate chunks without ever sending the final chunk. The server buffers all chunks in RAM indefinitely until the SecureChannel times out.

The attack is pre-session and bypasses all encryption configurations. The issue affects open62541: from 1.4.0 through 1.4.16, from 1.5.0 through 1.5.4, master.

A flaw was found in open62541. This can lead to the server buffering large amounts of data indefinitely, causing server memory exhaustion and a Denial of Service (DoS) condition.

Affected versions: 1.4.0 through 1.4.16, 1.5.0 through 1.5.4. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Weakness: CWE-1284.

Affected versions

4.09
1.4.0
1.4.16
1.5.0
1.5.4

Official advisory · high-confidence parse· fetched 21 days ago·verify at source

Fixed versions

No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.

Official advisory · high-confidence parse· fetched 21 days ago·verify at source

Mitigation checklist

Recommended fix / mitigation

The issue has been fixed in v1.5.5.

Official advisory · high-confidence parse· fetched 21 days ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.