The OPC UA Project maintains a machine-to-machine communication protocol widely adopted in industrial automation and control systems, where a focused vulnerability footprint reflects the protocol's parsing and resource-management complexity. Observed weakness classes center on resource-exhaustion conditions and memory-safety issues such as unbounded allocation and out-of-bounds writes, which are characteristic of binary protocol implementations handling untrusted network input. Current severity, exploitation status, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Opcua Project over time
Signals from CVEs in this vendor scope (3 CVEs).
3 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-25903HIGH The package opcua from 0.0.0 are vulnerable to Denial of Service (DoS) via the ExtensionObjects and Variants objects, when it allows unlimited nesting levels, which could result in | Aug 24, 2022 | 7.5 | 24 | NO | NO |
CVE-2022-25888HIGH The package opcua from 0.0.0 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurr | Aug 23, 2022 | 7.5 | 24 | NO | NO |
CVE-2022-25304HIGH All versions of package opcua; all versions of package asyncua are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single s | Aug 23, 2022 | 7.5 | 24 | NO | NO |
Signals from CVEs in this vendor scope (3 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Opcua Project.
Media articles that mention a CVE ID that affects a product developed by Opcua Project — matched by CVE ID, not by vendor name.