From c799467d9ca32bc5b0e27c361193583999951471 Mon Sep 17 00:00:00 2001 From: Ankur Tyagi Date: Mon, 7 Sep 2026 22:23:00 +1200 Subject: [PATCH] open62541: patch CVE-2026-11946 Backport commit identified by Debian[1] Details: https://nvd.nist.gov/vuln/detail/cve-2026-11946 [1]https://security-tracker.debian.org/tracker/CVE-2026-11946 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal --- .../opcua/open62541/CVE-2026-11946.patch | 48 +++++++++++++++++++ .../opcua/open62541_1.4.16.bb | 1 + 2 files changed, 49 insertions(+) create mode 100644 meta-networking/recipes-protocols/opcua/open62541/CVE-2026-11946.patch diff --git a/meta-networking/recipes-protocols/opcua/open62541/CVE-2026-11946.patch b/meta-networking/recipes-protocols/opcua/open62541/CVE-2026-11946.patch new file mode 100644 index 0000000000..36c9c83af1 --- /dev/null +++ b/meta-networking/recipes-protocols/opcua/open62541/CVE-2026-11946.patch @@ -0,0 +1,48 @@ +From 47df558c02eef86bec125a54284b78563d1928b8 Mon Sep 17 00:00:00 2001 +From: Niels Beier +Date: Thu, 7 May 2026 15:25:30 +0200 +Subject: [PATCH] fix(server): Enforce default message and chunk size limits to + prevent DoS + +When tcpMaxMsgSize or tcpMaxChunks are configured as 0, the server treats the +limit as truly unbounded. A remote attacker can exploit this by sending +arbitrarily large messages or an unbounded number of chunks, exhausting server +memory and causing a denial of service. + +Set safe defaults (512 MB per message, 16384 chunks) whenever the configured +value is zero, mirroring the existing behaviour for recv/sendBufferSize. + +This commit mitigates a vulnerability reported by Lorenzo Cannella. + +Internal Vulnerability Advisory: open62541-SA-2026-0002 + +(cherry picked from commit c9563e8ea4a8db2f64059c8ff7efe0b49a35bea3) + +CVE: CVE-2026-11946 +Upstream-Status: Backport [https://github.com/open62541/open62541/commit/c9563e8ea4a8db2f64059c8ff7efe0b49a35bea3] + +Signed-off-by: Ankur Tyagi +--- + src/server/ua_server_binary.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/src/server/ua_server_binary.c b/src/server/ua_server_binary.c +index b2de3b271..13859ce56 100644 +--- a/src/server/ua_server_binary.c ++++ b/src/server/ua_server_binary.c +@@ -1114,6 +1114,15 @@ createServerSecureChannel(UA_BinaryProtocolManager *bpm, UA_ConnectionManager *c + if(connConfig.sendBufferSize == 0) + connConfig.sendBufferSize = 1 << 16; /* 64kB */ + ++ if(connConfig.localMaxMessageSize == 0) ++ connConfig.localMaxMessageSize = 1 << 29; /* 512 MB */ ++ if(connConfig.remoteMaxMessageSize == 0) ++ connConfig.remoteMaxMessageSize = 1 << 29; /* 512 MB */ ++ if(connConfig.localMaxChunkCount == 0) ++ connConfig.localMaxChunkCount = 1 << 14; /* 16384 */ ++ if(connConfig.remoteMaxChunkCount == 0) ++ connConfig.remoteMaxChunkCount = 1 << 14; /* 16384 */ ++ + /* Set up the new SecureChannel */ + UA_SecureChannel_init(&entry->channel); + entry->channel.config = connConfig; diff --git a/meta-networking/recipes-protocols/opcua/open62541_1.4.16.bb b/meta-networking/recipes-protocols/opcua/open62541_1.4.16.bb index 32f7148f4b..b9edc5fe30 100644 --- a/meta-networking/recipes-protocols/opcua/open62541_1.4.16.bb +++ b/meta-networking/recipes-protocols/opcua/open62541_1.4.16.bb @@ -18,6 +18,7 @@ SRC_URI = " \ git://github.com/Pro/mdnsd.git;name=mdnsd;protocol=https;branch=master;destsuffix=${BB_GIT_DEFAULT_DESTSUFFIX}/deps/mdnsd \ git://github.com/OPCFoundation/UA-Nodeset;name=ua-nodeset;protocol=https;branch=latest;destsuffix=${BB_GIT_DEFAULT_DESTSUFFIX}/deps/ua-nodeset \ git://github.com/LiamBindle/MQTT-C.git;name=mqtt-c;protocol=https;branch=master;destsuffix=${BB_GIT_DEFAULT_DESTSUFFIX}/deps/mqtt-c \ + file://CVE-2026-11946.patch \ "