{"id":"CVE-2024-33862","published":"2024-07-05T00:00:00Z","modified":"2024-08-02T02:42:59Z","title":"A buffer-management vulnerability in OPC Foundation OPCFoundation.NetStandard.Opc.Ua.Core before 1.05.374.54 could…","vendor":null,"product":null,"tier":"tail","description":{"text":"A buffer-management vulnerability in OPC Foundation OPCFoundation.NetStandard.Opc.Ua.Core before 1.05.374.54 could allow remote attackers to exhaust memory resources. It is triggered when the system receives an excessive number of messages from a remote source. This could potentially lead to a denial of service (DoS) condition, disrupting the normal operation of the system.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.00557,"percentile":0.4645,"provenance":"source"},"cwes":[{"id":"CWE-770","name":"Allocation of Resources Without Limits or Throttling"}],"references":[{"url":"https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2024-33862.pdf","tags":[]}],"priority":{"score":14.5,"factors":[{"name":"EPSS percentile","points":9.29},{"name":"CVSS severity","points":5.25}]},"affected":[{"ecosystem":"NuGet","package":"OPCFoundation.NetStandard.Opc.Ua.Core","vulnerableRanges":["<1.5.374.54"],"patched":["1.5.374.54"],"from":["GHSA-4q2p-hwmr-qcxc"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-2248","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-opcfoundation-netstandard-opc-ua-core-cve-2024-33862","children":[{"from":"CVE-2024-33862","to":"CVE-2024-42512","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["Stack/Opc.Ua.Core/Stack/Tcp/TcpTransportListener.cs"],"commits":["https://github.com/OPCFoundation/UA-.NETStandard/commit/52d4492ccc928f128e7a38857fdf58d94e1e652b","https://github.com/OPCFoundation/UA-.NETStandard/commit/3543d0292556691f681e39145e2de4526b90487d"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2022-29865","published":"2022-06-16","fixed":"1.4.368.58","kev":false},{"cve":"CVE-2022-29866","published":"2022-06-16","fixed":"1.4.368.58","kev":false},{"cve":"CVE-2023-31048","published":"2023-12-12","fixed":"1.4.371.86","kev":false,"link":{"from":"CVE-2023-31048","to":"CVE-2024-33862","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"NuGet:OPCFoundation.NetStandard.Opc.Ua.Core","fromFixed":"1.4.371.86","toFixed":"1.5.374.54","daysApart":206}]}},{"cve":"CVE-2024-33862","published":"2024-07-05","fixed":"1.5.374.54","kev":false},{"cve":"CVE-2024-45526","published":"2024-10-22","fixed":"1.5.374.118","kev":false,"link":{"from":"CVE-2024-33862","to":"CVE-2024-45526","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"NuGet:OPCFoundation.NetStandard.Opc.Ua.Core","fromFixed":"1.5.374.54","toFixed":"1.5.374.118","daysApart":109},{"kind":"similar","provenance":"machine","score":0.46,"basis":"same package + description similarity"}]}},{"cve":"CVE-2024-42512","published":"2025-02-10","fixed":"1.5.374.158","kev":false}],"package":"NuGet:OPCFoundation.NetStandard.Opc.Ua.Core"}}