CVE-2026-67858

This is not a URL parsing bug. It's a cardinality failure at the protocol boundary where open62541's LDS translates unbounded OPC UA registration data into mDNS service advertisements—which have hard size limits. The trigger is sending many unique discoveryUrls, not a malformed one. This means the overflow occurs during collection accumulation or translation, not during input validation. Check your build: this affects open62541 versions through 1.5.5 with MDNSD support compiled in. MDNSD is not enabled by default—it's a compile-time feature. If your deployment doesn't use mDNS-based discovery, you're not affected, but verify your build configuration anyway since many industrial deployments ship with discovery backends that operators never explicitly enabled. The unauthenticated attack surface is the critical deployment factor. RegisterServer and RegisterServer2 are discovery bootstrapping calls intentionally left open in OPC UA to support zero-configuration networking. At the network perimeter, you should enforce request size limits and consider rate limiting on these endpoints regardless of this CVE—they accept unbounded input by design in the spec. The non-obvious risk: the DoS trigger that causes the buffer overflow also forces the LDS to broadcast every discoveryUrl it receives into mDNS TXT records. Successful exploitation doesn't just crash the service—it gives a network-adjacent attacker a complete map of every discoverable endpoint in that LDS domain. That's intelligence that enables targeted follow-on operations, not just availability loss. If you're maintaining an open62541 deployment, audit whether MDNSD is enabled, check whether your network boundary rate-limits discovery registration calls, and monitor for sudden mDNS traffic spikes from your LDS—this could indicate exploitation attempts. The EPSG score is low (0.00487) not because the flaw is hard to exploit but because MDNSD is an obscure code path that attackers may not have instrumented to find targets yet.

Reviewed through automated stages and approved by a human before publication.