CVE-2026-102509
HighCVSS 8.7Summary
A vulnerability in Apache PLC4X (Java implementation, PLC4J) allows a malicious or impersonated device to exhaust the memory or stack of the client application, causing a denial of service. In the OPC UA driver, these defects are reachable before authentication, during secure channel and session establishment, before the server's identity is bound. Affects versions 0.10.0 through 0.13.1.
Risk Assessment
The organization is exposed to DoS attacks from an unauthenticated attacker who can impersonate a trusted server, leading to unavailability of PLC4X client applications. Configuring a trusted server does not prevent exploitation.
Recommendation
Upgrade Apache PLC4X to version 1.0.0 immediately, which fixes the issue. Before upgrading, restrict network access to client applications and monitor for unusual memory usage.
Other vulnerabilities in Apache PLC4X
See all- CVE-2026-102511High
A vulnerability in the Go implementation of Apache PLC4X (PLC4Go) involves improper verification of the source of a communication channel during ADS discovery. An attacker can send a spoofed UDP datagram to the discovering host, redirecting subsequent connections to an arbitrary address. The connection address is derived from the AmsNetId in the response body rather than the datagram's actual source. Additionally, a single malformed datagram can disable discovery listeners in both PLC4Go and PLC4J implementations, causing panics, exceptions, or infinite loops.
- CVE-2026-102510High
The Go implementation of Apache PLC4X (PLC4Go) contains multiple severe defects, including integer overflow, improper validation of array indices, uncontrolled recursion, and memory allocation with excessive size values. A malicious device or an attacker able to inject network traffic can crash or exhaust the memory of the client application, causing a denial of service.
- CVE-2026-102508Critical
The OPC UA driver in Apache PLC4X (PLC4J) improperly verifies cryptographic signatures and server certificates. An attacker in a network position between client and server can impersonate the OPC UA server and read, forge, or modify secure-channel traffic, including user credentials sent by the client. The issue affects versions 0.9.0 through 0.13.1 and is fixed in version 1.0.0.
Original NVD description (English source)
Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits, and Uncontrolled Recursion in the Java implementation of Apache PLC4X (PLC4J) allow a malicious or impersonated device to exhaust the memory or stack of the client application, causing a denial of service. In the OPC UA driver these defects are reachable before authentication: the offending data is parsed while the secure channel and session are being established, before the server's identity has been bound to it. Configuring a trusted server therefore does not prevent exploitation by an attacker who can impersonate it. The individual defects are: - Length-prefixed byte strings are allocated at the size claimed on the wire before the length is checked against the data actually received (0.10.0 through 0.13.1). - Array fields in generated protocol parsers pre-allocate a list with the element count claimed on the wire, allowing a single count field to trigger a multi-gigabyte allocation. This parser is shared by all PLC4J drivers; the OPC UA driver is the verified pre-authentication path (0.10.0 through 0.13.1). - The OPC UA driver accumulates message chunks without enforcing the negotiated maximum chunk count and message size (0.12.0 through 0.13.1). - The OPC UA driver pre-allocates collections using element counts received from the server (0.10.0 through 0.13.1). - Recursive protocol types are parsed without a nesting-depth limit. The same defect in the Go implementation is covered by CVE-2026-102510 https://cveprocess.apache.org/cve5/CVE-2026-102510 . This issue affects Apache PLC4X: from 0.10.0 before 1.0.0. Users are recommended to upgrade to version 1.0.0, which fixes the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS