CVE-2023-27321

OPC Foundation UA .NET Standard ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability

7.5 HighFix available

OPC Foundation UA .NET Standard ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of OPC Foundation UA .NET Standard. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of OPC UA ConditionRefresh requests. By sending a large number of requests, an attacker can consume all available resources on the server. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-20505.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

1.05%Up 1.0 points since May 8, 2024

What each source reports

CVE List Score used 7.5

OPC Foundation UA .NET Standard ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability

Record: CVE-2023-27321
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400
Updated: 2026-11-02

EUVDEUVD-2023-1630 7.5

Record: EUVD-2023-1630
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-vpf7-r2fv-75m9 7.5

Uncontrolled Resource Consumption in OPC UA .NET Standard Reference Server

This security update resolves a vulnerability in the OPC UA .NET Standard Reference Server that allows remote attackers to send malicious requests that consume all memory available to the server.

https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2023-27321.pdf

Record: GHSA-vpf7-r2fv-75m9
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400
Updated: 2026-11-02

NVD 7.5

Record: CVE-2023-27321
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400
Updated: 2026-11-02

OSV 7.5

OPC Foundation UA .NET Standard ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability

Record: CVE-2023-27321
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400
Updated: 2026-11-02

OSVGHSA-vpf7-r2fv-75m9 7.5

Uncontrolled Resource Consumption in OPC UA .NET Standard Reference Server

This security update resolves a vulnerability in the OPC UA .NET Standard Reference Server that allows remote attackers to send malicious requests that consume all memory available to the server.

https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2023-27321.pdf

Record: GHSA-vpf7-r2fv-75m9
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`OPCFoundation.NetStandard.Opc.Ua.Server` NuGet	before 1.4.371.86	1.4.371.86
`OPCFoundation.NetStandard.Opc.Ua.Server` NuGet	before 1.4.371.86, plus listed versions 1.4.363.104-preview1.4.363.1071.4.364.401.4.365-gfc341ee8c51.4.365.1-preview Show 25 moreShow less 1.4.365.101.4.365.21.4.365.231.4.365.481.4.366.31-preview1.4.366.381.4.367.1001.4.367.391.4.367.411.4.367.421.4.367.64-preview1.4.367.751.4.367.951.4.368.27-preview1.4.368.331.4.368.52-preview1.4.368.531.4.368.581.4.369.301.4.370.11.4.370.121.4.370.91.4.371.411.4.371.501.4.371.60	1.4.371.86

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-27321 is a high vulnerability (CVSS 7.5) in Opc Foundation Ua .net Standard, published May 5, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.05%, the 64th percentile. Fixed in OPCFoundation.NetStandard.Opc.Ua.Server 1.4.371.86.