{"id":"CVE-2026-61387","details":"In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server-global reservation is not restored. Deeply nested PubSub ExtensionObjects in a `CreateMonitoredItems` event filter can trigger a `StackOverflowError` during decoding, allowing an unauthenticated remote client to exhaust a finite global monitored-item quota and prevent all clients from creating new monitored items until restart. Existing monitored items and other server functions remain unaffected.","modified":"2026-08-07T08:11:16.135925Z","published":"2026-08-04T11:52:38.259Z","database_specific":{"cwe_ids":["CWE-400","CWE-460","CWE-772"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61387.json","cna_assigner":"eclipse"},"references":[{"type":"WEB","url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/182"},{"type":"WEB","url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/598"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61387.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61387"},{"type":"FIX","url":"https://github.com/eclipse-milo/milo/commit/587e35669f519b2d7f6d850a5f86ee5a76c3a2c5"},{"type":"FIX","url":"https://github.com/eclipse-milo/milo/commit/5f3f6da2a5ea80682e1da7c58f7a1870b09d2b43"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/eclipse-milo/milo","events":[{"introduced":"96e072a738bf9b3e9b50a8479cc712a6ec81eb68"},{"fixed":"8e84cd7d0d8e6eb787f89c5c1319b885d666fe4b"},{"fixed":"587e35669f519b2d7f6d850a5f86ee5a76c3a2c5"},{"fixed":"5f3f6da2a5ea80682e1da7c58f7a1870b09d2b43"}],"database_specific":{"cpe":"cpe:2.3:a:eclipse:milo:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.0.0"},{"fixed":"1.1.5"}],"source":["CPE_RANGE","REFERENCES"]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61387.json","vanir_signatures_modified":"2026-08-07T08:11:16Z","vanir_signatures":[{"id":"CVE-2026-61387-13571328","signature_type":"Function","signature_version":"v1","source":"https://github.com/eclipse-milo/milo/commit/5f3f6da2a5ea80682e1da7c58f7a1870b09d2b43","target":{"file":"opc-ua-sdk/sdk-server/src/main/java/org/eclipse/milo/opcua/sdk/server/subscriptions/SubscriptionManager.java","function":"modifyMonitoredItem"},"deprecated":false,"digest":{"function_hash":"316041716505531987611696011982583931743","length":3044}},{"target":{"file":"opc-ua-sdk/sdk-server/src/main/java/org/eclipse/milo/opcua/sdk/server/subscriptions/SubscriptionManager.java","function":"createMonitoredEventItem"},"deprecated":false,"digest":{"function_hash":"222118802621478541148151869359336945291","length":890},"id":"CVE-2026-61387-522404c7","signature_type":"Function","signature_version":"v1","source":"https://github.com/eclipse-milo/milo/commit/5f3f6da2a5ea80682e1da7c58f7a1870b09d2b43"},{"signature_version":"v1","source":"https://github.com/eclipse-milo/milo/commit/5f3f6da2a5ea80682e1da7c58f7a1870b09d2b43","target":{"file":"opc-ua-sdk/sdk-server/src/main/java/org/eclipse/milo/opcua/sdk/server/subscriptions/SubscriptionManager.java"},"deprecated":false,"digest":{"line_hashes":["61851531294985962064086427635901787529","180011515077949218513775543246742432030","216297595626718673887431767648743877686","141112183251216660698028709468285775669","297836448749922271345573955245394043526","204985878488143556376436540618667482394","171571546113294207418112579352220260520","124583362270940891150141520638256651705","20826071142957404658062232998218965035","111576648363084404373254372248756802516","286225271752514989647271158752771070472","104286294540727043590266651459980557226","178705253803304497784378584985423001894","266709215860123701145312741424144287596","174406088210162789395328080601287697843","282280317034194460119035759175903578565","264227638580919217821285593501055808078","102570408782549975115000572784419706649","236004050791113907693780955193922654316","308214809219001145883983102141745193850","151545403309009756738555738086391943297","122480088596979641398199659649740887203","152089091696816122202187633606861200873","9494684523644312884998293201565412490","261185142975048411657145631547818469594","110037026159013633949564666933649368944","33199651577216818455058913934012482682","207433167762364558249166519518070991806","60941847524185743850970334828227809945","107821762696964830738420780420859385442","213090377513070778016173670577618488393","82279937352257895403894327829183393489","271265564721242908971648728220868795341","128722138632798771996169393175900219464","51500464240755989458311510049380054020","290307808569670479725352866198666834870","148534940114243371513988868313476859315","206850447242405076561521853097332711861","121986973720662560161112165874452423908","106459783263922608704279910651943804369","260708830043740763919139582926597784250","250054073038987484006833953077295161715","148534940114243371513988868313476859315","206850447242405076561521853097332711861","121986973720662560161112165874452423908"],"threshold":0.9},"id":"CVE-2026-61387-5318520d","signature_type":"Line"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/eclipse-milo/milo/commit/587e35669f519b2d7f6d850a5f86ee5a76c3a2c5","target":{"file":"opc-ua-stack/stack-core/src/main/java/org/eclipse/milo/opcua/stack/core/types/builtin/ExtensionObject.java"},"deprecated":false,"digest":{"line_hashes":["75822143451507819150126294204721328157","10696813688969484697566208435705583470","93899820598787660507033694403455739383","78948020205975576953878867027608175698","337620207749954005844820158351076352613","13740650802883064984502938811789947978","327380779998628363093363983166965693776"],"threshold":0.9},"id":"CVE-2026-61387-88c6b6b6"},{"deprecated":false,"digest":{"function_hash":"8148271435166086039284796628012885712","length":153},"id":"CVE-2026-61387-d7c81184","signature_type":"Function","signature_version":"v1","source":"https://github.com/eclipse-milo/milo/commit/587e35669f519b2d7f6d850a5f86ee5a76c3a2c5","target":{"file":"opc-ua-stack/stack-core/src/main/java/org/eclipse/milo/opcua/stack/core/types/builtin/ExtensionObject.java","function":"decode"}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["174063440710075394721034918022313415763","148243143990109487809840075324119039692","186883213661845136563688384171143074484","84408711877205836865817403345874584778","132455922959258097672084601489842925802","306558943402443476563523721363261029482","125276804714099165184143275122686001170","15785867783073954491997368316825842826","8099355558265414732543062644984940452"]},"id":"CVE-2026-61387-d93996f9","signature_type":"Line","signature_version":"v1","source":"https://github.com/eclipse-milo/milo/commit/587e35669f519b2d7f6d850a5f86ee5a76c3a2c5","target":{"file":"opc-ua-stack/stack-core/src/test/java/org/eclipse/milo/opcua/stack/core/encoding/binary/OpcUaDefaultBinaryEncodingTest.java"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/eclipse-milo/milo/commit/5f3f6da2a5ea80682e1da7c58f7a1870b09d2b43","target":{"file":"opc-ua-sdk/sdk-server/src/main/java/org/eclipse/milo/opcua/sdk/server/subscriptions/SubscriptionManager.java","function":"createMonitoredItems"},"deprecated":false,"digest":{"function_hash":"276791246431096317008662709203240029060","length":2147},"id":"CVE-2026-61387-e5b3fa5f"}]}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}]}