Niels Beier 9c1636a232 fix(server): Cap default outstanding PublishRequest count per session ...

The default server configuration zero-initialises
maxPublishReqPerSession, which disables the per-session cap on
outstanding PublishRequest entries. A remote client that is allowed
to create a session and a subscription can therefore send an
unbounded number of PublishRequest messages, each of which allocates
a UA_PublishResponseEntry and appends it to the session's publish
queue. The resulting monotonic heap growth causes process memory
exhaustion and a denial of service.

Set a safe finite default of 512 outstanding PublishRequests per
session in setDefaultConfig() so that the cap is enforced out of the
box, while still allowing deployers to override it.

Internal Vulnerability Advisory: open62541-SA-2026-0010
Co-Authored-By: keyme <kmm2003@users.noreply.github.com>

2026-07-09 14:10:23 +02:00

..

crypto

fix(plugin): fix namelist allocated from scandir not freed

2025-12-09 11:20:38 +01:00

historydata

Revert "Merge branch 'master' into 1.3"

2021-12-18 14:34:34 +01:00

include/open62541

feat(plugin): allow custom password validation

2023-09-28 12:50:19 +02:00

mqtt

fix(pubsub): Integrate the mqtt-c library as a Git submodule in 1.3

2022-06-14 11:36:55 +02:00

ua_accesscontrol_default.c

fix(plugins): Use the session parameters feature instead of storing data in the SessionContext

2025-11-05 11:34:01 +01:00

ua_config_default.c

fix(server): Cap default outstanding PublishRequest count per session

2026-07-09 14:10:23 +02:00

ua_debug_dump_pkgs.c

Use correct identifier labels and encode bytestring as base64

2018-07-04 08:10:01 +02:00

ua_log_stdout.c

fix(plugin): Declare log constants static

2023-08-09 15:58:56 +02:00

ua_log_syslog.c

Revert "Merge branch 'master' into 1.3"

2021-12-18 14:34:34 +01:00

ua_nodestore_hashmap.c

Revert "Merge branch 'master' into 1.3"

2021-12-18 14:34:34 +01:00

ua_nodestore_ziptree.c

Revert "Merge branch 'master' into 1.3"

2021-12-18 14:34:34 +01:00

ua_pubsub_ethernet.c

Revert "Merge branch 'master' into 1.3"

2021-12-18 14:34:34 +01:00

ua_pubsub_mqtt.c

fix(pubsub): Integrate the mqtt-c library as a Git submodule in 1.3

2022-06-14 11:36:55 +02:00

ua_pubsub_udp.c

fix(core): DataValue statuscodes checks ignore additional information bits (#5375)

2022-10-20 08:38:46 +02:00