CVE-2022-29866: 
C# vulnerability analysis and mitigation

CVE-2022-29866 affects the OPC Foundation UA .NET Standard Stack version 1.04.368. The vulnerability was discovered by Uriya Yavnieli from JFrog Security Research Team and was disclosed on June 16, 2022. This security flaw allows remote attackers to exhaust memory resources of a server through crafted requests that trigger uncontrolled resource consumption (ZDI Advisory, AttackerKB).

The vulnerability exists within the TranslateBrowsePathsToNodeId method of the UA .NET Standard Stack. The core issue stems from improper validation of user-supplied data, which can result in a memory exhaustion condition. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (High) with the vector string AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating it can be exploited remotely without requiring privileges or user interaction (ZDI Advisory).

If successfully exploited, this vulnerability allows attackers to create a denial-of-service condition on affected systems by exhausting server memory resources. This can result in the server becoming unresponsive and unable to process legitimate requests (ZDI Advisory).

OPC Foundation has released an update to address this vulnerability. Users are advised to upgrade to the patched version of the UA .NET Standard Stack (ZDI Advisory).