What’s Vulnerable › Vulnerabilities

CVE-2022-25903: Denial of Service (DoS)

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-08-24 · updated 2026-06-17
• Weakness: CWE-787

Description

The package opcua from 0.0.0 are vulnerable to Denial of Service (DoS) via the ExtensionObjects and Variants objects, when it allows unlimited nesting levels, which could result in a stack overflow even if the message size is less than the maximum allowed.

Affected products

• opcua: from 0.0.0

References

• https://github.com/locka99/opcua/pull/216
• https://github.com/locka99/opcua/pull/216/commits/e75dada28a40c3fefc4aeee4cdc272e1b748f8dd
• https://security.snyk.io/vuln/SNYK-RUST-OPCUA-2988750
• https://github.com/locka99/opcua/pull/216
• https://github.com/locka99/opcua/pull/216/commits/e75dada28a40c3fefc4aeee4cdc272e1b748f8dd
• https://security.snyk.io/vuln/SNYK-RUST-OPCUA-2988750

Get alerted when CVE-2022-25903 or the next vulnerability affects your stack