CVE-2019-19135

Insufficient Nonce Validation in Eclipse Milo Client

7.4 HighFix available

In OPC Foundation OPC UA .NET Standard codebase 1.4.357.28, servers do not create sufficiently random numbers in OPCFoundation.NetStandard.Opc.Ua before 1.4.359.31, which allows man in the middle attackers to reuse encrypted user credentials sent over the network.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: None

Exploit likelihood

1.04%Up 0.4 points since Apr 14, 2021

What each source reports

NVD Score used 7.4

Record: CVE-2019-19135
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0: 5.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:N
Weakness: CWE-330
Updated: 2026-11-02

CVE List No score

Record: CVE-2019-19135
Updated: 2026-11-02

EUVDEUVD-2020-0355 No score

Record: EUVD-2020-0355
Updated: 2026-11-03

GitHub AdvisoriesGHSA-pq4w-qm9g-qx68 7.4

Insufficient Nonce Validation in Eclipse Milo Client

Impact

Credential replay affecting those connected to a server when all 3 of the following conditions are met:

SecurityPolicy is None
using username/password or X509-based authentication
the server has a defect causing it to send null/empty or zeroed nonces

Patches

The problem has been patched in version 0.3.6. A more relaxed treatment of validation as agreed upon by the OPC UA Security Working Group is implemented in version 0.3.7.

Workarounds

Do not use username/password or X509-based authentication with SecurityPolicy of None.

References

https://opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2019-19135.pdf

For more information

If you have any questions or comments about this advisory:

Open an issue at https://github.com/eclipse/milo/issues
Email the mailing list

Record: GHSA-pq4w-qm9g-qx68
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-330, CWE-522
Updated: 2026-11-02

OSV 7.4

Record: CVE-2019-19135
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVGHSA-pq4w-qm9g-qx68 7.4

Insufficient Nonce Validation in Eclipse Milo Client

Impact

Credential replay affecting those connected to a server when all 3 of the following conditions are met:

SecurityPolicy is None
using username/password or X509-based authentication
the server has a defect causing it to send null/empty or zeroed nonces

Patches

The problem has been patched in version 0.3.6. A more relaxed treatment of validation as agreed upon by the OPC UA Security Working Group is implemented in version 0.3.7.

Workarounds

Do not use username/password or X509-based authentication with SecurityPolicy of None.

References

https://opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2019-19135.pdf

For more information

If you have any questions or comments about this advisory:

Open an issue at https://github.com/eclipse/milo/issues
Email the mailing list

Record: GHSA-pq4w-qm9g-qx68
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-330, CWE-522
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.eclipse.milo:sdk-client` Maven	through 0.3.4	0.3.6
`org.eclipse.milo:sdk-client` Maven	before 0.3.6, plus listed versions 0.1.00.1.10.1.20.1.30.1.4 Show 20 moreShow less 0.1.50.1.60.2.00.2.10.2.20.2.30.2.40.2.50.3.00.3.0-M10.3.10.3.1-M10.3.20.3.2-M10.3.30.3.3-RC10.3.3-RC20.3.3-RC30.3.40.3.5	0.3.6

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-19135 is a high vulnerability (CVSS 7.4) in Opcfoundation Netstandard.opc.ua, published March 16, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.04%, the 64th percentile. Fixed in org.eclipse.milo:sdk-client 0.3.6.