High severity · published Aug 4, 2026
CVE-2026-61387
In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server-global reservation…
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server-global reservation is not restored. Deeply nested PubSub ExtensionObjects in a `CreateMonitoredItems` event filter can trigger a `StackOverflowError` during decoding, allowing an unauthenticated remote client to exhaust a finite global monitored-item quota and prevent all clients from creating new monitored items until restart. Existing monitored items and other server functions remain unaffected.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EM
Eclipse Milo · Eclipse Foundation
1.0.0 before 1.1.5 · source: vendor
MI
Milo · Eclipse
1.0.0 before 1.1.5 · source: NVD
In the news
VulnerabilityHigh
Eclipse Foundation Eclipse Milo
View CSAF
Summary
Successful exploitation of these vulnerabilities could allow an attacker to delete protected data, recover user credentials and impersonate legitimate users, or cause the server to stop responding to all clients.
The following versions of Eclipse Foundation Eclipse Milo are affected:
Eclipse Milo >=0.6.0|<=1.1.4 (CVE-2026-63252, CVE-2026-63248, CVE-2026-60007)
Eclipse Milo >=1.0.0|<=1.1.4 (CVE-2026-62927, CVE-2026-58080, CVE-2026-61387)
CVSS
Vendor
Equipment
v3 8.2
Eclipse Foundation
Eclipse Milo
5 Vulnerabilities
Incorrect Authorization, Missing Release of Memory after Effective Lifetime, Missing Authorization, Observable Response Discrepancy, Missing Release of Resource after Effective Lifetime
Background
Critical Infrastructure Sectors: Chemical, Critical Manufacturing, Energy, Water and Wastewater
Countries/Areas Deployed: Worldwide
Company Headquarters Location: Belgium
Vulnerabilities
Expand All +
CVE-2026-62927
In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization, allowing an anonymous or otherwise low-privileged client to execute a denied method by batching it with an allowed method.
Read More
1 Affected Product
Eclipse Foundation Eclipse Milo: >=1.0.0|<=1.1.4
Product Status: known_affected
Remediations...
Oct 15, 2026·CISA Advisories
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-61387
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-61387
Patch
https://github.com/eclipse-milo/milo/commit/587e35669f519b2d7f6d850a5f86ee5a76c3a2c5
Patch
https://github.com/eclipse-milo/milo/commit/5f3f6da2a5ea80682e1da7c58f7a1870b09d2b43
Broken Link
https://gitlab.eclipse.org/security/cve-assignment/-/work_items/182
Issue Tracking
https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/598
More from Eclipse Milo
8.2
CVE-2026-58080
In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a configured `RoleMapper`
7.5
CVE-2026-63252
In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message chunks when a channel disconnects, allowing a remote…
7.5
CVE-2026-62927
In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization, allowing an anonymous…
7.4
CVE-2026-60007
In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures,…
6.5
CVE-2026-63248
In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization