Versions of the package asyncua before 0.9.96 are vulnerable to Denial of Service (DoS) such that an attacker can send a malformed packet and as a result, the server will enter into an infinite loop and consume excessive memory.
The product does not properly control the allocation and maintenance of a limited resource.
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
| Link | Tags |
|---|---|
| https://security.snyk.io/vuln/SNYK-PYTHON-ASYNCUA-5673709 | patch third party advisory exploit |
| https://gist.github.com/artfire52/1540b234350795e0ecb4d672608dbec8 | third party advisory exploit |
| https://github.com/FreeOpcUa/opcua-asyncio/issues/1013 | third party advisory issue tracking exploit |
| https://github.com/FreeOpcUa/opcua-asyncio/pull/1039 | patch |
| https://github.com/FreeOpcUa/opcua-asyncio/commit/f6603daa34a93a658f0e176cb0b9ee5a6643b262 | patch |
| https://github.com/FreeOpcUa/opcua-asyncio/releases/tag/v0.9.96 | product release notes |