Apache PLC4X CVE-2026-102509

Exploitation requires the PLC4J (Java) client to use the OPC UA driver and to initiate a connection to an attacker-controlled or impersonated server; the attacker must be able to act as (or on-path intercept and impersonate) the OPC UA server the client connects to. No authentication is needed (PR:N) because the length-prefixed byte string, array pre-allocation, chunk-accumulation, and unbounded recursion defects are triggered during secure-channel/session establishment, before server identity is bound - so pinning a trusted server does NOT prevent it. Limiting factors: the client must actively connect to the malicious/impersonated endpoint (the attacker cannot push unsolicited traffic to an idle client), the affected component is a client-side library rather than a listening service, and impact is confined to denial of service of the client application. The shared array-parser defect exists in all PLC4J drivers, but OPC UA is the verified pre-auth path.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, availability-only VA:H = 8.7) is internally consistent with the description: a remote, unauthenticated, network-reachable denial-of-service with no confidentiality or integrity impact. The most significant qualifier is that in the OPC UA driver the parsing defects are reachable BEFORE authentication - during secure-channel/session establishment, before the server's identity is bound - so configuring a trusted server does not mitigate an attacker who can impersonate it. This raises real exploitability relative to a post-auth DoS. Counter-signals lower the practical priority: no EPSS score, no CISA KEV listing, and no public POC are provided, so this is no public exploit identified at time of analysis rather than confirmed exploitation. The impact ceiling is DoS only (crash/resource exhaustion of the client application) - there is no code execution or data exposure. Net: a genuinely remotely-triggerable pre-auth availability flaw in an industrial-protocol library, but bounded impact and a niche deployment footprint keep it below the 'urgent' tier. No conflicting signals were detected; the CVSS vector matches the described behavior.

A malicious or impersonated OPC UA server (or an on-path attacker impersonating a trusted PLC/server) responds to a PLC4J client's connection attempt with a message declaring an enormous length prefix or array element count, or with deeply-nested recursive protocol types. The PLC4J parser pre-allocates a multi-gigabyte buffer/list or recurses without a depth limit while the secure channel is still being established, exhausting the client's heap or stack and crashing the application. No POC is available and no authentication is required, since the defect triggers before session identity is bound.