CVE-2026-63252 is a high severity (CVSS 7.5) denial of service in the Eclipse Milo OPC UA server SDK. In versions 0.6.0 through 1.1.4, partial message chunks are not released when a channel disconnects. An unauthenticated client can exhaust direct memory. Version 1.1.5 lists the fix.
What's affected
The record says Eclipse Milo 0.6.0 through 1.1.4. The Eclipse CVE reservation lists the same range and rates it 8.7 High on CVSS 4.0, against the record's 7.5 High on CVSS 3.1. The weakness is CWE-401 (missing release of memory after its effective lifetime).
UASC server transport handlers keep partial message chunks while they wait for the rest. If the channel closes first, those chunks are never released. A remote client without credentials can repeat this, drain the pooled direct memory and potentially stop the server.
The v1.1.5 release notes include a change about releasing chunks on teardown, which matches. Confirm against your build. This is a sibling of CVE-2026-62927, which affects a narrower version range.
How to check if you're exposed
Check the resolved version of Milo in each server.
mvn dependency:tree -Dincludes=org.eclipse.milo
Versions 0.6.0 through 1.1.4 are affected per the record. For a running server, watch direct buffer memory use over time. A steady climb that does not fall when clients disconnect fits the leak, though other causes are possible. The free in-browser dependency scan at gold.safeguard.sh/scan can list the matching dependencies in a manifest or lockfile you paste in.
What to do now
- Inventory servers and gateways that embed Eclipse Milo, including those from vendors.
- Upgrade to 1.1.5 or later and redeploy.
- Limit network access to the OPC UA port to known clients while you patch.
- Set JVM direct memory limits and alerts so a leak raises an alarm instead of silently taking the process down.
- Add automatic restart and health checks for the server process as a safety net.
Why it matters
A leak under attacker control becomes a denial of service. Each partial message costs a little memory, and a client that opens and drops connections can repeat that until the pool is empty. Pooled direct memory sits outside the normal Java heap, so heap monitors can miss the growth.
In industrial systems, availability is often the main concern, so a remote unauthenticated way to stop a server is worth a quick fix. The class is CWE-401. The record does not list the CVE as exploited in the wild.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this need credentials?
No. The record describes a remote unauthenticated client, because the handlers affected run before a session is established.
Sources
Last reviewed: 18 October 2026.
