Security Vulnerabilities
Information Disclosure when processing wireless network channel switch information with improperly formatted length fields.
CVSS Score
6.5
EPSS Score
0.001
Published
2026-08-04
Information Disclosure when IPSec negotiation fails or is not established properly during NG-eCall SIP signaling.
CVSS Score
6.5
EPSS Score
0.001
Published
2026-08-04
Cryptographic Issue while processing registration requests with malformed or missing authentication parameters.
CVSS Score
8.1
EPSS Score
0.001
Published
2026-08-04
Memory Corruption when handling malformed request parameters in the fingerprint TA.
CVSS Score
7.8
EPSS Score
0.001
Published
2026-08-04
Memory corruption while processing a packet with a size close to the maximum allowed value.
CVSS Score
7.8
EPSS Score
0.001
Published
2026-08-04
Memory Corruption when processing registry values with incorrect types using a direct query method.
CVSS Score
6.7
EPSS Score
0.001
Published
2026-08-04
In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a configured `RoleMapper`. On servers that rely on role permissions and construct the running configuration through `copy()`, sessions receive no role IDs and the default access controller skips role-permission checks, allowing an anonymous client where anonymous sessions are permitted to read role-permission metadata, invoke protected methods, or delete protected nodes.
CVSS Score
8.8
EPSS Score
0.003
Published
2026-08-04
In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim's `Basic128Rsa15`-encrypted username token to use repeated unauthenticated `ActivateSession` requests as a padding oracle, recover the victim's password, and authenticate with the recovered credentials.
CVSS Score
9.1
EPSS Score
0.004
Published
2026-08-04
In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server-global reservation is not restored. Deeply nested PubSub ExtensionObjects in a `CreateMonitoredItems` event filter can trigger a `StackOverflowError` during decoding, allowing an unauthenticated remote client to exhaust a finite global monitored-item quota and prevent all clients from creating new monitored items until restart. Existing monitored items and other server functions remain unaffected.
CVSS Score
6.9
EPSS Score
0.003
Published
2026-08-04
In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization, allowing an anonymous or otherwise low-privileged client to execute a denied method by batching it with an allowed method.
CVSS Score
8.7
EPSS Score
0.003
Published
2026-08-04