mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-09-27 12:40:19 +00:00
Code Issues Projects Releases Wiki Activity

open62541: patch CVE-2026-11946

Browse Source 
Backport commit identified by Debian[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-11946

[1]https://security-tracker.debian.org/tracker/CVE-2026-11946

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Ankur Tyagi
2026-09-15 10:13:35 +05:30
committed by Anuj Mittal
parent 6093ccb547
commit c799467d9c
2 changed files with 49 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-networking/recipes-protocols/opcua/open62541/CVE-2026-11946.patch
+48
View File
@@ -0,0 +1,48 @@
From 47df558c02eef86bec125a54284b78563d1928b8 Mon Sep 17 00:00:00 2001
From: Niels Beier <niels.beier@o6-automation.com>
Date: Thu, 7 May 2026 15:25:30 +0200
Subject: [PATCH] fix(server): Enforce default message and chunk size limits to
prevent DoS
When tcpMaxMsgSize or tcpMaxChunks are configured as 0, the server treats the
limit as truly unbounded. A remote attacker can exploit this by sending
arbitrarily large messages or an unbounded number of chunks, exhausting server
memory and causing a denial of service.
Set safe defaults (512 MB per message, 16384 chunks) whenever the configured
value is zero, mirroring the existing behaviour for recv/sendBufferSize.
This commit mitigates a vulnerability reported by Lorenzo Cannella.
Internal Vulnerability Advisory: open62541-SA-2026-0002
(cherry picked from commit c9563e8ea4a8db2f64059c8ff7efe0b49a35bea3)
CVE: CVE-2026-11946
Upstream-Status: Backport [https://github.com/open62541/open62541/commit/c9563e8ea4a8db2f64059c8ff7efe0b49a35bea3]
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
src/server/ua_server_binary.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/src/server/ua_server_binary.c b/src/server/ua_server_binary.c
index b2de3b271..13859ce56 100644
--- a/src/server/ua_server_binary.c
+++ b/src/server/ua_server_binary.c
@@ -1114,6 +1114,15 @@ createServerSecureChannel(UA_BinaryProtocolManager *bpm, UA_ConnectionManager *c
if(connConfig.sendBufferSize == 0)
connConfig.sendBufferSize = 1 << 16; /* 64kB */
+ if(connConfig.localMaxMessageSize == 0)
+ connConfig.localMaxMessageSize = 1 << 29; /* 512 MB */
+ if(connConfig.remoteMaxMessageSize == 0)
+ connConfig.remoteMaxMessageSize = 1 << 29; /* 512 MB */
+ if(connConfig.localMaxChunkCount == 0)
+ connConfig.localMaxChunkCount = 1 << 14; /* 16384 */
+ if(connConfig.remoteMaxChunkCount == 0)
+ connConfig.remoteMaxChunkCount = 1 << 14; /* 16384 */
+
/* Set up the new SecureChannel */
UA_SecureChannel_init(&entry->channel);
entry->channel.config = connConfig;
meta-networking/recipes-protocols/opcua/open62541_1.4.16.bb
+1
View File
@@ -18,6 +18,7 @@ SRC_URI = " \
git://github.com/Pro/mdnsd.git;name=mdnsd;protocol=https;branch=master;destsuffix=${BB_GIT_DEFAULT_DESTSUFFIX}/deps/mdnsd \
git://github.com/OPCFoundation/UA-Nodeset;name=ua-nodeset;protocol=https;branch=latest;destsuffix=${BB_GIT_DEFAULT_DESTSUFFIX}/deps/ua-nodeset \
git://github.com/LiamBindle/MQTT-C.git;name=mqtt-c;protocol=https;branch=master;destsuffix=${BB_GIT_DEFAULT_DESTSUFFIX}/deps/mqtt-c \
file://CVE-2026-11946.patch \
"