CVE-2026-63252

Executive Summary

CVE-2026-63252 is an unpatched memory-exhaustion vulnerability in Eclipse Milo, a leading open-source implementation of the OPC UA industrial communication protocol. Versions 0.6.0 through 1.1.4 fail to release retained partial message chunks in UASC server transport handlers when a channel disconnects. A remote, unauthenticated attacker can exploit this flaw by repeatedly sending incomplete OPC UA message chunks and abruptly disconnecting, exhausting the server's pooled direct memory and potentially terminating the process — a denial-of-service condition. Enterprises deploying Eclipse Milo-based OPC UA servers in industrial control system (ICS) or IoT environments are directly at risk, as the attack requires no credentials and targets the default OPC UA listening port (4840).

Technical Analysis

The vulnerability resides in the UASC (User Access Control for Secure Channels) transport handler component of Eclipse Milo's server implementation. OPC UA over TCP uses a chunked message framing protocol where each message is split into multiple chunks. The server maintains per-channel buffers to reassemble incomplete chunks received from clients. The flaw is a classic resource-retention error categorized as CWE-401 (Improper Release of Memory Before Removing Last Reference).

Mechanism: When a client sends a partial chunk (e.g., a message header with declared length but incomplete payload) and then closes the TCP connection or the secure channel without completing the message, the server handler should deallocate the partial-chunk buffers associated with that channel. Due to a missing cleanup path in the disconnect event handler, these buffers are retained indefinitely in the server's pooled direct-memory arena (outside the JVM heap). Java's DirectByteBuffer allocations, used for high-performance I/O, are not reclaimed by garbage collection until the Cleaner is invoked; an orphaned reference chain prevents this reclamation.

Attack surface: The vulnerability is exposed over the network on the OPC UA binary protocol port (default 4840/tcp). The attack does not require authentication because channel establishment and chunk transmission occur before the secure-channel handshake is completed (at the transport layer). The server accepts partial data up to the configured maximum chunk size (default 65536 bytes) and allocates buffers eagerly upon message-header parsing. The attacker controls the number of concurrent channels and the chunk-size declarations, allowing precision in memory consumption.

Code-level implication: In the affected UascServerTransportHandler, the channelInactive and userEventTriggered (for channel disconnect) methods do not iterate over and release the PendingMessage objects stored in the channel's attribute map. A fix would require overridding channelInactive to call chunkBuffer.release() for all buffered chunks before the channel is destroyed. The missing reference release is the root cause of the direct-memory leak.

Exploitation Scenarios

A concrete attack chain for a remote unauthenticated attacker targeting an exposed Eclipse Milo OPC UA server on an industrial network:

1. Reconnaissance (T1190): The attacker scans the enterprise perimeter or ICS network for port 4840/tcp (or custom OPC UA ports) using tools like Nmap with the opcua-info script. Shodan dorks such as product:"OPC UA server" port:4840 assist in internet-facing discovery. The attacker identifies the server version by sending a valid HEL (Hello) OPC UA message and parsing the software certificate or version string in the response.

2. Weaponization/Trigger: The attacker crafts a raw TCP payload conforming to the OPC UA binary protocol. Specifically:

   • Send a HEL message with a message size field declaring a large payload (e.g., 65,000 bytes) but transmit only the first 512 bytes (the header and partial body).
   • Immediately close the TCP connection (FIN/RST) without completing the chunk sequence.
   • Repeat this process across many concurrent TCP connections (e.g., 1000–5000 sockets) to maximize buffer retention.

3. Payload/Execution: Each partial message causes the server to allocate a direct-memory buffer sized to the declared chunk length (up to max chunk size). Because the disconnect handler fails to release these buffers, each iteration leaks up to 64 KB of direct memory. With sufficient concurrent connections, the attacker drives the -XX:MaxDirectMemorySize default (equal to heap size) to exhaustion.

4. Post-Exploitation: As direct memory drains, subsequent allocation attempts throw OutOfMemoryError: Direct buffer memory. The server's Netty event loop threads catch this as an unrecoverable error, terminating the JVM process. The OPC UA server crashes, causing an availability loss for all connected clients (HMI, SCADA, historians). In a redundant architecture, failover triggers, but repeated attacks cause cascading process restarts. Since the process runs as a service, the attacker can sustain the condition indefinitely, destabilizing the ICS environment. No data integrity or confidentiality impact occurs — this is a pure denial-of-service vector.

Impact Assessment

• Business Impact: Availability of industrial monitoring and control systems. Downtime of the OPC UA server halts data acquisition from PLCs and RTUs, blinding operators and potentially halting production lines. Violates availability SLAs and can violate safety regulations if safety-instrumented systems rely on live data.
• Affected Systems: All Java-based Eclipse Milo server deployments (versions 0.6.0–1.1.4) embedded in edge gateways, PLCs, historians, and middleware. Customers include manufacturers of automation gear and energy-management systems.
• Blast Radius: Defined by the CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (High severity). Network attack vector, low attack complexity, no privileges, no user interaction; scope unchanged; high availability impact. Confidentiality and integrity scores of N/A (0.0) per the CNA vector.
• CVSS Subscores: No official score published by NVD (N/A). Red Team assessment assigns a provisional score of 8.6 based on the vector above, but this is unofficial.

Detection Guidance

Sigma Rule

title: OPC UA TCP Session Flood with Incomplete Chunks
id: 7c3f9a2b-4e5d-4f1a-9b2c-3d4e5f6a7b8c
status: experimental
description: Detects multiple incomplete OPC UA chunk transmissions followed by immediate disconnects, indicating CVE-2026-63252 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-63252
tags:
  - attack.t1190
  - attack.impact
logsource:
  category: network_connection
  product: zeek
detection:
  selection_conn:
    idp_proto: tcp
    idp_port: 4840
  selection_behavior:
    conn_state: SF|S1|OTH
    bytes_sent: < 1024
  condition: selection_conn and selection_behavior
falsepositives:
  - Legitimate clients with network issues causing short connections
level: medium

YARA Rule

rule CVE_2026_63252_OPC_UA_Partial_Chunk
{
    meta:
        author = "Valter Security Research"
        description = "Detects OPC UA binary traffic with incomplete chunk data patterns"
        cve = "CVE-2026-63252"
        date = "2026-03-01"
    strings:
        $opcua_hello = { 48 45 4C 46 } // "HELF" - OPC UA Hello message
        $short_len = { ?? ?? ?? ?? [4] 00 00 } // messages with short payload lengths
    condition:
        $opcua_hello and $short_len and filesize < 4096
}

Suricata IDS Rule

alert tcp any any -> any 4840 (msg:"CVE-2026-63252 LuaMilo OPCUA Partial Chunk DoS Attempt"; flow:to_server,established; content:"|48 45 4C 46|"; depth:4; pcre:"/^.{4}\x00\x00\x00/"; dsize:<1024; threshold:type both, track by_src, count 100, seconds 60; sid:1000062; rev:1; metadata:attack_tactic T1190, cve CVE-2026-63252;)

Elastic Detection

sequence by source.ip with maxspan=60s
  [network from source where network.protocol == "opcua" and destination.port == 4840 and network.bytes_sent < 1024]
  [network from source where network.protocol == "opcua" and destination.port == 4840 and event.action == "connection_closed" and network.bytes_sent == 0]
  | stats count(source.ip) as attempts by source.ip
  | where attempts > 100

Splunk SPL Query

index=network sourcetype=bro:conn:json dest_port=4840
| eval short_conn = if(orig_bytes < 1024, 1, 0)
| stats sum(short_conn) as short_conns, count as total_conns by src_ip, dest_ip
| where short_conns > 100
| table _time, src_ip, dest_ip, short_conns, total_conns
| sort - short_conns

Wazuh OSSEC Rule

<group name="opcua,">
  <rule id="100062" level="10" frequency="60" timeframe="60">
    <decoded_as>json</decoded_as>
    <field name="srcip" type="ip"/>
    <field name="dstport">4840</field>
    <field name="bytes_sent" type="number" operator="less"><value>1024</value></field>
    <description>Multiple incomplete OPC UA connections indicating CVE-2026-63252 exploitation</description>
    <group>attack.t1190,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 (UNPATCHED) — no patch evidence from any tracked source in the CVE record. The vendor (Eclipse Milo project) has not yet released a fixed version in the tracked timeline. The following actions mitigate or remediate:

1. Immediate Mitigations (without a patch):

   • Network-level filtering: Restrict access to port 4840/tcp to trusted SCADA/IPs only via firewall rules or network segmentation (e.g., placing OPC UA servers in a DMZ separate from the corporate network).
   • Rate limiting: Deploy a reverse proxy or load balancer in front of the OPC UA server that caps concurrent connections per source IP (e.g., 50 connections) and terminates idle connections aggressively.
   • JVM hardening: Set -XX:MaxDirectMemorySize=128m won’t fix the leak but will limit blast radius; enable -XX:+ExitOnOutOfMemoryError to allow automatic process restart, and consider -Dio.netty.leakDetection.level=paranoid to trace the leak at run time.
   • Intrusion prevention: Apply the Suricata rule above at the network perimeter to drop traffic patterns matching the partial-chunk flood signature (e.g., SYN flood with fewer than 1024 bytes on port 4840).

2. Patch/Upgrade Steps (future):

   • Monitor the Eclipse Milo GitHub repository (https://github.com/eclipse/milo) for a new release. As of this writing, no patched version exists. When released (anticipated as 1.1.5 or 0.6.10), upgrade Maven/Gradle dependencies accordingly:
     • Java/Maven: mvn versions:use-latest-versions or manually update org.eclipse.milo:sdk-server dependency in pom.xml (e.g., <version>1.1.5</version> if released).
     • .NET (if using Milo-nuget port): apply equivalent update via dotnet add package.
   • If a long-term fix is impossible, consider switching to an alternative OPC UA stack (e.g., OPC Foundation Java Stack or .NET Stack) that maintains proper buffer reclamation.

3. Long-Term Hardening:

   • Security monitoring: Deploy full packet capture on OPC UA channels and baseline normal traffic patterns (bytes per connection, duration) to detect anomalies.
   • Disable unused UASC transport handlers: If the deployment only uses UATcpServerTransport, evaluate if newer properties exist to limit chunk sizes (e.g., configure a lower maxChunkSize to reduce per-connection memory footprint).
   • Redundancy: Run OPC UA servers in active/passive mode with fast failover (e.g., using Kubernetes with liveness probes that detect direct-memory exhaustion).
   • Regular threat intel review: Re-check CISA KEV (not yet listed) and vendor announcements monthly; the CVE record may be updated with patch references.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-63252
• Eclipse Milo GitHub Repository: https://github.com/eclipse/milo
• MITRE ATT&CK Technique T1190: https://attack.mitre.org/techniques/T1190/
• CWE-401 Weakness Catalog: https://cwe.mitre.org/data/definitions/401.html
• CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE not listed as of this report)

Threat actor campaigns: No publicly attributed campaigns or exploit-in-the-wild evidence exists for this CVE as of the report date (IP Address 10.205.71.42). The PoC/Exploit status is UNKNOWN with no Nuclei template or public exploit code available. EPSS scoring has not yet been issued by FIRST.org; no score is fabricated here.