CVE-2022-25304

What it actually does

The vulnerability permits an attacker to exhaust server resources by sending an unlimited number of large message chunks without the final closing chunk, either per session or across concurrent sessions.

Why it matters to the business

Disruption of industrial control and automation systems that rely on these libraries can lead to operational downtime, halted manufacturing processes, and potential safety issues in critical infrastructure environments.

How an attack unfolds

An attacker connects to an OPC UA endpoint, opens one or more sessions, and floods the server with oversized chunks without ever sending the final chunk, causing unbounded memory or CPU consumption until the service becomes unresponsive.

How to fix it

Upgrade the opcua and asyncua packages to versions that enforce chunk limits as soon as such releases become available; in the interim apply network-level rate limiting and segmentation for OPC UA traffic.

How to confirm the fix worked

Inspect installed package versions against vendor advisories, review server configuration for any added chunk-size or session limits, and perform controlled testing to confirm that incomplete chunk streams are rejected or throttled.

Typical attack path

1. Connect to a vulnerable OPC UA server endpoint
2. Initiate one or more sessions
3. Transmit repeated large chunks (for example 2 GB each) without the final chunk
4. Continue the pattern across sessions until resource exhaustion occurs

How to detect it

Examine OPC UA server logs for unusually high volumes of incomplete or oversized message chunks, repeated session initiations without message completion, and sudden spikes in memory or CPU usage tied to the OPC UA process.

What your security team should do

• Track upstream releases for fixed versions of opcua and asyncua and deploy them promptly
• Place OPC UA endpoints behind network controls that limit connection rates and message sizes
• Monitor for signs of resource exhaustion on servers hosting these libraries