GHSA-qm9f-c3v9-wphv
Security Update for the OPC UA .NET Standard Stack
This security update resolves a vulnerability in the OPC UA .NET Standard Stack that enables an unauthorized attacker to trigger a rapid increase in memory consumption.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
What each source reports
GitHub Advisories Score used
Security Update for the OPC UA .NET Standard Stack
This security update resolves a vulnerability in the OPC UA .NET Standard Stack that enables an unauthorized attacker to trigger a rapid increase in memory consumption.
- Record
GHSA-qm9f-c3v9-wphv- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSV
Security Update for the OPC UA .NET Standard Stack
This security update resolves a vulnerability in the OPC UA .NET Standard Stack that enables an unauthorized attacker to trigger a rapid increase in memory consumption.
- Record
GHSA-qm9f-c3v9-wphv- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
OPCFoundation.NetStandard.Opc.Ua.CoreNuGet | before 1.05.374.54 | 1.05.374.54 |
OPCFoundation.NetStandard.Opc.UaNuGet | before 1.05.374.54 | 1.05.374.54 |
OPCFoundation.NetStandard.Opc.Ua.CoreNuGet | before 1.05.374.54, plus listed versions 0.0.30.0.60.0.70.0.80.0.9 Show 45 moreShow less0.1.00.1.10.1.20.1.30.1.50.1.60.1.70.1.80.1.90.2.00.2.10.2.20.2.30.2.41.4.363.104-preview1.4.363.1071.4.364.401.4.365-gfc341ee8c51.4.365.1-preview1.4.365.101.4.365.21.4.365.231.4.365.481.4.366.31-preview1.4.366.381.4.367.1001.4.367.391.4.367.411.4.367.421.4.367.64-preview1.4.367.751.4.367.951.4.368.27-preview1.4.368.331.4.368.52-preview1.4.368.531.4.368.581.4.369.301.4.370.11.4.370.121.4.370.91.4.371.411.4.371.501.4.371.601.4.371.86 | 1.05.374.54 |
OPCFoundation.NetStandard.Opc.UaNuGet | before 1.05.374.54, plus listed versions 0.4.00.4.10.4.30.4.40.4.5 Show 45 moreShow less1.3.3481.3.3491.3.3501.3.350.11.3.350.31.3.350.41.3.350.51.3.350.61.3.351.71.3.352.101.3.352.111.3.352.121.3.352.91.4.353.131.4.353.141.4.353.151.4.354.16-preview1.4.354.18-preview1.4.354.19-preview1.4.354.20-preview1.4.354.211.4.354.231.4.355.24-preview1.4.355.251.4.355.261.4.356.271.4.357.281.4.358.29-preview1.4.358.301.4.359.311.4.360.331.4.360.341.4.361.381.4.361.391.4.362.40-preview1.4.362.41-preview1.4.362.421.4.363.104-preview1.4.363.1071.4.363.47-preview1.4.363.48-preview1.4.363.491.4.364.401.4.365.1-preview1.4.365.10 | 1.05.374.54 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-qm9f-c3v9-wphv is a high vulnerability (CVSS 7.5) in OPCFoundation.NetStandard.Opc.Ua.Core, published October 18, 2024. No source lists public exploit code. Fixed in OPCFoundation.NetStandard.Opc.Ua.Core 1.05.374.54.
References
Left out here: 77 versions. The JSON record has them.