CVE-2026-102510
HighCVSS 8.7Summary
The Go implementation of Apache PLC4X (PLC4Go) contains multiple severe defects, including integer overflow, improper validation of array indices, uncontrolled recursion, and memory allocation with excessive size values. A malicious device or an attacker able to inject network traffic can crash or exhaust the memory of the client application, causing a denial of service.
Risk Assessment
Organizations using PLC4Go are exposed to denial-of-service attacks that can disrupt industrial systems or applications communicating with PLC devices. Additionally, when forwarding payloads larger than 8 KB, the remainder of the payload may be interpreted as additional independent protocol messages, potentially leading to unintended actions by controllers.
Recommendation
Upgrade Apache PLC4X to version 1.0.0 immediately, which fixes the issue. If upgrading is not possible, limit trust in network data and implement additional traffic filtering mechanisms.
Other vulnerabilities in Apache PLC4X
See all- CVE-2026-102511High
A vulnerability in the Go implementation of Apache PLC4X (PLC4Go) involves improper verification of the source of a communication channel during ADS discovery. An attacker can send a spoofed UDP datagram to the discovering host, redirecting subsequent connections to an arbitrary address. The connection address is derived from the AmsNetId in the response body rather than the datagram's actual source. Additionally, a single malformed datagram can disable discovery listeners in both PLC4Go and PLC4J implementations, causing panics, exceptions, or infinite loops.
- CVE-2026-102508Critical
The OPC UA driver in Apache PLC4X (PLC4J) improperly verifies cryptographic signatures and server certificates. An attacker in a network position between client and server can impersonate the OPC UA server and read, forge, or modify secure-channel traffic, including user credentials sent by the client. The issue affects versions 0.9.0 through 0.13.1 and is fixed in version 1.0.0.
Original NVD description (English source)
Integer Overflow, Improper Validation of Array Index, Uncontrolled Recursion and Memory Allocation with Excessive Size Value in the Go implementation of Apache PLC4X (PLC4Go) allow a malicious device, or an attacker able to inject network traffic, to crash or exhaust the memory of the client application, causing a denial of service. The individual defects are: - Generated parsers pre-allocate arrays with the element count claimed on the wire (0.13.0 through 0.13.1). - Transport read helpers allocate buffers of the size claimed on the wire without an upper bound. - ADS and KNXnet/IP response handling indexes into received data without checking its length, causing a panic. - ADS and EIP frame-length handling accepts, or arithmetically wraps to, a length of zero, breaking message framing. - Recursive protocol types are parsed without a nesting-depth limit. The same defect in the Java implementation is covered by CVE-2026-102509 https://cveprocess.apache.org/cve5/CVE-2026-102509 . Additionally, length and position arithmetic in generated serializers was performed in 16-bit integers. If an application forwards attacker-influenced payloads larger than 8 KB, the length field wraps, and the remainder of the payload may be interpreted by the receiving device (for example, an ADS PLC) as additional, independent protocol messages. This issue affects Apache PLC4X: from 0.11.0 before 1.0.0. PLC4Go is consumed as the Go module github.com/apache/plc4x/plc4go; versions refer to the corresponding Apache PLC4X releases. Users are recommended to upgrade to version 1.0.0, which fixes the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS