High severity · published Sep 8, 2022
CVE-2022-25897
The package org.eclipse.milo:sdk-server before 0.6.8 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multiple…
7.5
CVSS
1.3%
EPSS
No
On KEV
Description
The package org.eclipse.milo:sdk-server before 0.6.8 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MI
Milo · Eclipse
before 0.6.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-25897
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-25897
Patch
https://github.com/eclipse/milo/commit/4534381760d7d9f0bf00cbf6a8449bb0d13c6ce5
Issue Tracking
https://github.com/eclipse/milo/issues/1030
Patch
https://github.com/eclipse/milo/pull/1031
Third Party Advisory
https://security.snyk.io/vuln/SNYK-JAVA-ORGECLIPSEMILO-2990191
More from Milo
8.2
CVE-2026-58080
In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a configured `RoleMapper`
7.5
CVE-2026-63252
In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message chunks when a channel disconnects, allowing a remote…
7.5
CVE-2026-62927
In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization, allowing an anonymous…
7.5
CVE-2026-61387
In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server-global reservation…
7.4
CVE-2026-60007
In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures,…