{"id":"CVE-2026-63252","details":"In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message chunks when a channel disconnects, allowing a remote unauthenticated client to exhaust pooled direct memory by repeatedly sending incomplete chunks and disconnecting, potentially terminating the server.","modified":"2026-08-07T08:11:21.935790Z","published":"2026-08-04T12:03:18.647Z","database_specific":{"cna_assigner":"eclipse","cwe_ids":["CWE-401"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63252.json"},"references":[{"type":"WEB","url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/179"},{"type":"WEB","url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/598"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63252.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63252"},{"type":"FIX","url":"https://github.com/eclipse-milo/milo/commit/459715793ec54b0f33367a14f94264500a0d872b"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/eclipse-milo/milo","events":[{"introduced":"9fd8a23ae26263ccd8045d02eae0f9466d06207b"},{"fixed":"8e84cd7d0d8e6eb787f89c5c1319b885d666fe4b"},{"fixed":"459715793ec54b0f33367a14f94264500a0d872b"}],"database_specific":{"cpe":"cpe:2.3:a:eclipse:milo:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0.6.0"},{"fixed":"1.1.5"}],"source":["CPE_RANGE","REFERENCES"]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63252.json","vanir_signatures_modified":"2026-08-07T08:11:21Z","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/eclipse-milo/milo/commit/459715793ec54b0f33367a14f94264500a0d872b","target":{"file":"opc-ua-stack/transport/src/main/java/org/eclipse/milo/opcua/stack/transport/server/uasc/UascServerAsymmetricHandler.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["67722395501294816332931068932179844270","150888224049027930975302085115596093165","6218609095438898923883669471770326447","328671901996692577856718526715478491747","291842826828862570816637875962582550243","183856969366356914781792498430818544386","188106714198970856948579450419254643662","62945511848782263672472441537524701360","9675312024109701550716538567383744325","20518527381865228264456906432313521350","245620851098676483670842812991669572163","52777469648083437224233599385542121457","276988724860449908118992139944917383635","185570803767534516772124325089260994323","295376416636680936231002778227395205663","13722597094941190176362332955509128420","339717914312397622988274692295522412375","7583305293522251139925659367757540947","293202732226248207014445174233269284476","37711632782908915668618397578614747495","24370927946707728984207790985854451412","278332719026363204821720833852840077965","105389844258632010772102478160723370057","281714004913719841014132147747001540364","168531119163546654115769247539723587793","142669225680860989045288914858858237196","286063743207995744710261876212060815607","7560621816536458952744348818719120100","147695524439464751870197466720282717534","329034887856188146233876480982306206027","129402133871023074055805087125108900764","36920530688218323021587630647514167413","9289881262943539842337267156801829674","88253983170395036480019702459460203322","100175176886811196835457207380601981366","86353629415961894130249423682334852726","83475006867878337385800168675195442319","57626058705545161369949870890507737160"]},"id":"CVE-2026-63252-149534b3"},{"deprecated":false,"digest":{"function_hash":"125406678446826433314957055499816046973","length":515},"id":"CVE-2026-63252-276f085b","signature_type":"Function","signature_version":"v1","source":"https://github.com/eclipse-milo/milo/commit/459715793ec54b0f33367a14f94264500a0d872b","target":{"file":"opc-ua-stack/transport/src/main/java/org/eclipse/milo/opcua/stack/transport/server/uasc/UascServerSymmetricHandler.java","function":"UascServerSymmetricHandler"}},{"deprecated":false,"digest":{"function_hash":"156992570543556588212808554389042841357","length":681},"id":"CVE-2026-63252-2fc18cd8","signature_type":"Function","signature_version":"v1","source":"https://github.com/eclipse-milo/milo/commit/459715793ec54b0f33367a14f94264500a0d872b","target":{"file":"opc-ua-stack/transport/src/main/java/org/eclipse/milo/opcua/stack/transport/server/uasc/UascServerAsymmetricHandler.java","function":"exceptionCaught"}},{"signature_version":"v1","source":"https://github.com/eclipse-milo/milo/commit/459715793ec54b0f33367a14f94264500a0d872b","target":{"file":"opc-ua-stack/transport/src/main/java/org/eclipse/milo/opcua/stack/transport/server/uasc/UascServerAsymmetricHandler.java","function":"channelInactive"},"deprecated":false,"digest":{"function_hash":"197618319775300814136964593169669041607","length":188},"id":"CVE-2026-63252-56645d9a","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"72569864044808285046748779149632565643","length":491},"id":"CVE-2026-63252-8d6ef59c","signature_type":"Function","signature_version":"v1","source":"https://github.com/eclipse-milo/milo/commit/459715793ec54b0f33367a14f94264500a0d872b","target":{"function":"decode","file":"opc-ua-stack/stack-core/src/main/java/org/eclipse/milo/opcua/stack/core/channel/ChunkDecoder.java"}},{"deprecated":false,"digest":{"line_hashes":["171353719256937458492597972413708788283","140652814475365662448131519269030578130","201223825325292881628205876287176691820","277433705890388185916968475186131381144","150363741917346337922973273113165904678","251811968072672527515107399273597885433","100349949510190353976686532444402497252","233437559858017975964404854522520550047","170395298381372082869706895592870524464","319575590090075780704424881943212517313","90782033012519366882476884849995035984","197866315417330679455393115836970563006","118223885608931402294104672285416422951","249953497543337025326518654744298437898","18471315408084852474169025701076411331","56951130247203210217356162426421750546","185630565691136669371197151194345472855","242783573986894543532421485793947061963","242268347560764232098688472442022537853","253017048524533750466000732773649195638","14780058945085808762633228402283907851","310501747663433692738155157323696199753","118136197378222938571177367940967645800","73412861426588978971329626863851751893","293140631318569847903724771513038708219","219867733266645255295338011477107748300","144642489722123144788402725691256574707","166739007712974316088382795701001062717","32386963725393911634250252278928084717","306661788058721661754351469040130258147","82140944793527971795542666378915905730","307666938068136333448235806626400601700","202795701862583182827784190800721085282","331956825322889668781978058731403716742","6455828087056121211680032647322633876"],"threshold":0.9},"id":"CVE-2026-63252-a0c5907a","signature_type":"Line","signature_version":"v1","source":"https://github.com/eclipse-milo/milo/commit/459715793ec54b0f33367a14f94264500a0d872b","target":{"file":"opc-ua-stack/stack-core/src/main/java/org/eclipse/milo/opcua/stack/core/channel/ChunkDecoder.java"}},{"digest":{"function_hash":"279610390420943027782360839098604895285","length":1868},"id":"CVE-2026-63252-a8b0d39d","signature_type":"Function","signature_version":"v1","source":"https://github.com/eclipse-milo/milo/commit/459715793ec54b0f33367a14f94264500a0d872b","target":{"file":"opc-ua-stack/transport/src/main/java/org/eclipse/milo/opcua/stack/transport/server/uasc/UascServerSymmetricHandler.java","function":"onSecureMessage"},"deprecated":false},{"digest":{"function_hash":"231693050009952525497309601866916252849","length":2287},"id":"CVE-2026-63252-ba24ee2b","signature_type":"Function","signature_version":"v1","source":"https://github.com/eclipse-milo/milo/commit/459715793ec54b0f33367a14f94264500a0d872b","target":{"file":"opc-ua-stack/stack-core/src/main/java/org/eclipse/milo/opcua/stack/core/channel/ChunkDecoder.java","function":"decode"},"deprecated":false},{"source":"https://github.com/eclipse-milo/milo/commit/459715793ec54b0f33367a14f94264500a0d872b","target":{"file":"opc-ua-stack/stack-core/src/main/java/org/eclipse/milo/opcua/stack/core/channel/ChunkDecoder.java","function":"decodeSymmetric"},"deprecated":false,"digest":{"function_hash":"75053780343714485084481340885241690142","length":292},"id":"CVE-2026-63252-dde2e4a1","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/eclipse-milo/milo/commit/459715793ec54b0f33367a14f94264500a0d872b","target":{"file":"opc-ua-stack/transport/src/main/java/org/eclipse/milo/opcua/stack/transport/server/uasc/UascServerSymmetricHandler.java"},"deprecated":false,"digest":{"line_hashes":["288521071368609811394410799426528777537","2931165302194296360531102264513798888","313538462350884200736670718501513504059","65236828201624671584499885371511107363","340019792521950168308375170010519592847","5776419499375376054813989182612085274","253025285526264721111237520499644600589","156102577096429555113293397240053299509","335442902238125833213474063786151131985","157147521784118434332076721339255099048","203702327305703391898990021052895218781","206348207921598825272373345476536101555","318808630583842235472359669456686389105","159956818948287310499582900889202794980","90331364915538469279004392171561491437","168531119163546654115769247539723587793","142669225680860989045288914858858237196","268647073841069001915940107351516082222","229697840661373857062555495255138372113","86917805290220779906396655465517140413","329034887856188146233876480982306206027","129402133871023074055805087125108900764","36920530688218323021587630647514167413","9289881262943539842337267156801829674","88253983170395036480019702459460203322","100175176886811196835457207380601981366","335979041727474456276949140802165814547","28978362958816362348442059334371925331","124021443134180110260349989181155205261"],"threshold":0.9},"id":"CVE-2026-63252-dfc8b36f","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/eclipse-milo/milo/commit/459715793ec54b0f33367a14f94264500a0d872b","target":{"file":"opc-ua-stack/transport/src/main/java/org/eclipse/milo/opcua/stack/transport/server/uasc/UascServerAsymmetricHandler.java","function":"onOpenSecureChannel"},"deprecated":false,"digest":{"length":4829,"function_hash":"331714224689345931323123925432181281314"},"id":"CVE-2026-63252-f17d7ab2","signature_type":"Function"}]}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}