CVE-2026-61387

The CVSS 7.5 score understates the operational risk here because it abstracts away the intersection of unauthenticated access, permanent denial-of-service, and the industrial technology context where Eclipse Milo typically deploys. This is a precision DoS tool against process monitoring infrastructure, not a commodity vulnerability. The quota exhaustion pattern is architecturally mundane, but three characteristics make it analytically distinct. First, the attack is unauthenticated — no credentials required, just a network path to the OPC UA server. Second, the consumption is permanent: a StackOverflowError during decoding leaves the server-global reservation unreleased until restart, meaning a single triggering request can permanently wedge the system. Third, the blast radius is surgical — existing monitored items and other server functions continue normally, so the DoS is invisible to operations monitoring that would catch broader failures. The EPSS score of 0.00345 likely reflects that automated exploitation is non-trivial (crafting deeply nested PubSub ExtensionObjects to trigger stack overflow isn't standard scanner behavior). But this scoring misses the industrial context. OPC UA deployments in manufacturing, energy, and infrastructure are increasingly common, and monitored items are core to the pub/sub semantics operators depend on for real-time process visibility. An adversary who already has network access — or achieves it through a separate intrusion — gets a targeted, stealthy, persistent disruption mechanism without needing credentials or triggering alarms. The vulnerability also represents a class of failure: exception-unsafe resource accounting. The fix (restoring quota on unchecked exceptions) is straightforward, but the pattern suggests auditing is warranted for similar assumptions throughout the codebase. StackOverflowError isn't the only unchecked exception that could trigger this — OutOfMemoryError and VirtualMachineError would behave identically. For deployments that cannot patch immediately, the most practical compensating controls are network segmentation to limit who can reach the OPC UA endpoint, enforcing OPC UA authentication (user token policies), and monitoring for quota exhaustion patterns that would indicate the wedge is in place.

Reviewed through automated stages and approved by a human before publication.