CVE-2023-26151
asyncua vulnerable to denial of service via infinite loop
CVE-2023-26151 is a medium vulnerability (CVSS 5.3) in Freeopcua Opcua-asyncio, published October 3, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.18%, the 67th percentile. Fixed in asyncua 0.9.96.
Versions of the package asyncua before 0.9.96 are vulnerable to Denial of Service (DoS) such that an attacker can send a malformed packet and as a result, the server will enter into an infinite loop and consume excessive memory.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Versions of the package asyncua before 0.9.96 are vulnerable to Denial of Service (DoS) such that an attacker can send a malformed packet and as a result, the server will enter into an infinite loop and consume excessive memory.
- Record
CVE-2023-26151- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2023-0048
Versions of the package asyncua before 0.9.96 are vulnerable to Denial of Service (DoS) such that an attacker can send a malformed packet and as a result, the server will enter into an infinite loop and consume excessive memory.
- Record
EUVD-2023-0048- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gfvq-mxw3-mfq3
asyncua vulnerable to denial of service via infinite loop
Versions of the package asyncua before 0.9.96 are vulnerable to Denial of Service (DoS) such that an attacker can send a malformed packet and as a result, the server will enter into an infinite loop and consume excessive memory.
- Record
GHSA-gfvq-mxw3-mfq3- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-835
- Updated
- 2026-11-02
NVD
Versions of the package asyncua before 0.9.96 are vulnerable to Denial of Service (DoS) such that an attacker can send a malformed packet and as a result, the server will enter into an infinite loop and consume excessive memory.
- Record
CVE-2023-26151- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-835
- Updated
- 2026-11-02
OSV
Versions of the package asyncua before 0.9.96 are vulnerable to Denial of Service (DoS) such that an attacker can send a malformed packet and as a result, the server will enter into an infinite loop and consume excessive memory.
- Record
CVE-2023-26151- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVGHSA-gfvq-mxw3-mfq3
asyncua vulnerable to denial of service via infinite loop
Versions of the package asyncua before 0.9.96 are vulnerable to Denial of Service (DoS) such that an attacker can send a malformed packet and as a result, the server will enter into an infinite loop and consume excessive memory.
- Record
GHSA-gfvq-mxw3-mfq3- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-835
- Updated
- 2026-11-02
OSVPYSEC-2023-190
Versions of the package asyncua before 0.9.96 are vulnerable to Denial of Service (DoS) such that an attacker can send a malformed packet and as a result, the server will enter into an infinite loop and consume excessive memory.
- Record
PYSEC-2023-190- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-26151
Versions of the package asyncua before 0.9.96 are vulnerable to Denial of Service (DoS) such that an attacker can send a malformed packet and as a result, the server will enter into an infinite loop and consume excessive memory.
- Record
UBUNTU-CVE-2023-26151- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
asyncuaPyPI |
before 0.9.96 | 0.9.96 |
asyncuaPyPI |
before 0.9.96, plus listed versions 0.5.00.5.10.6.00.6.10.8.0 Show 21 moreShow less0.8.10.8.20.8.30.8.40.9.00.9.10.9.100.9.110.9.120.9.140.9.20.9.30.9.60.9.80.9.90.9.900.9.910.9.920.9.930.9.940.9.95 |
0.9.96 |
asyncuaPyPI |
before 0.9.96, plus listed versions 0.5.00.5.10.6.00.6.10.8.0 Show 45 moreShow less0.8.10.8.20.8.30.8.40.9.00.9.10.9.100.9.110.9.120.9.140.9.20.9.30.9.60.9.80.9.90.9.900.9.910.9.920.9.930.9.940.9.95v0.9.95v0.9.94v0.9.93v0.9.92v0.9.91v0.9.90v0.9.12v0.9.11v0.9.10v0.9.80.9.70.9.40.90.40.90.30.90.20.90.10.90.00.10.170.10.150.10.140.10.120.10.110.10.90.10.8 |
0.9.96 |
python-opcuaUbuntu:18.04:LTS |
All versions, plus listed versions 0.90.3-1 |
None known |
python-opcuaUbuntu:20.04:LTS |
All versions, plus listed versions 0.98.6-30.98.6-3ubuntu10.98.9-1 |
None known |
python-opcuaUbuntu:22.04:LTS |
All versions, plus listed versions 0.98.11-10.98.11-1ubuntu1 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases, published | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
security.snyk.io/vuln/SNYK-PYTHON-ASYNCUA-5673709
gist.github.com/artfire52/1540b234350795e0ecb4d672608dbec8
github.com/FreeOpcUa/opcua-asyncio/issues/1013
Show 7 moreShow less
nvd.nist.gov/vuln/detail/CVE-2023-26151
ubuntu.com/security/CVE-2023-26151
cve.org/CVERecord?id=CVE-2023-26151
Left out here: 14 versions. The JSON record has them.