PatchTheCEVCVE-2026-61387: In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item c
44
This month
HIGH 7.5REMOTEUPGRADE
CVE-2026-61387 is a high-severity flaw (CVSS 7.5) affecting milo. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server-global reservation is not restored. Deeply nested PubSub ExtensionObjects in a `CreateMonitoredItems` event filter can trigger a `StackOverflowError` during decoding, allowing an unauthenticated remote client to exhaust a finite global monitored-item quota and prevent all clients from crea
Why this priority
- High severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Publisher (CNA): Eclipse Foundation · Vendor: eclipse
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
eclipse milo UPGRADE
Affected: >= 1.0.0 and < 1.1.5
Fixed in: 1.1.5
Safe to downgrade to: a release before 1.0.0
1. Check installed version
apt-cache policy milo || rpm -q milo || milo --version
2. UPGRADE to 1.1.5 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade milo
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade milo
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 1.0.0 (Debian / Ubuntu)
apt-cache madison milo
sudo apt install milo=<VERSION_BEFORE_1.0.0>
sudo apt-mark hold milo
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list milo
sudo dnf downgrade milo-<VERSION_BEFORE_1.0.0>
sudo dnf versionlock add milo
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Advisories and coverage
Official advisories
- CISA ICS Advisories: Eclipse Foundation Eclipse Milo 2026-10-15
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Related CVEs
- CVE-2026-63252 HIGH 7.5 UPGRADE In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial
- CVE-2026-60007 HIGH 7.4 UPGRADE In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for inv
- CVE-2026-58080 HIGH 8.2 UPGRADE In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a configured `RoleM
- CVE-2026-62927 HIGH 7.5 UPGRADE In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-
- CVE-2026-63248 MEDIUM 6.5 UPGRADE In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorizat