CVE-2022-25304

All versions of package opcua; all versions of package asyncua are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited number of huge chunks (e.g. 2GB each) without sending the Final closing chunk.

• CWE-770

• https://github.com/FreeOpcUa/python-opcua/issues/1466Issue Tracking, Third Party Advisory
• https://security.snyk.io/vuln/SNYK-PYTHON-ASYNCUA-2988731Third Party Advisory
• https://security.snyk.io/vuln/SNYK-PYTHON-OPCUA-2988730Third Party Advisory
• https://github.com/FreeOpcUa/python-opcua/issues/1466Issue Tracking, Third Party Advisory
• https://security.snyk.io/vuln/SNYK-PYTHON-ASYNCUA-2988731Third Party Advisory
• https://security.snyk.io/vuln/SNYK-PYTHON-OPCUA-2988730Third Party Advisory

Published

Aug 23, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-25298This affects the package sprinfall/webcc before 0.3.0. It is…7.5
• CVE-2022-25299This affects the package cesanta/mongoose before 7.6. The un…7.5
• CVE-2022-2530Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-25301All versions of package jsgui-lang-essentials are vulnerable…9.8
• CVE-2022-25302All versions of package asneg/opcuastack are vulnerable to D…7.5
• CVE-2022-25303The package whoogle-search before 0.7.2 are vulnerable to Cr…6.1
• CVE-2022-25305The WP Statistics WordPress plugin is vulnerable to Cross-Si…6.1
• CVE-2022-25306The WP Statistics WordPress plugin is vulnerable to Cross-Si…6.1
• CVE-2022-25307The WP Statistics WordPress plugin is vulnerable to Cross-Si…6.1
• CVE-2022-25308A stack-based buffer overflow flaw was found in the Fribidi …7.8
• CVE-2022-25309A heap-based buffer overflow flaw was found in the Fribidi p…5.5
• CVE-2022-2531An issue has been discovered in GitLab EE affecting all vers…5.3