What is the CVSS score of CVE-2026-51539?

CVE-2026-51539 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of libmodbus are affected by CVE-2026-51539?

Libmodbus 3.1.12 on Windows contains a denial-of-service vulnerability (CVE-2026-51539) with publicly available exploit code that allows remote attackers to crash Modbus-based applications and…

How to fix or mitigate CVE-2026-51539?

Immediate actions (24 hours): Audit your environment to identify all Windows systems running libmodbus 3.1.12 or earlier versions, particularly those exposed to untrusted networks; implement network segmentation and firewall rules to restrict Modbus TCP connections to trusted endpoints only. Within seven days: Deploy enhanced monitoring on affected Modbus applications to detect connection stalling or resource exhaustion patterns, and test failover and redundancy mechanisms to ensure business continuity; consider implementing a reverse proxy or network appliance with connection timeout management in front of exposed Modbus services. Within 30 days: Monitor the libmodbus project for patch releases and establish a testing plan to validate updates in a controlled environment; evaluate alternative Modbus implementations if patches remain unavailable, and document all compensating controls implemented.

libmodbus CVE-2026-51539

EUVD-2026-43605 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-07-13 mitre

GHSA-4fx8-wmg3-693v

Denial Of Service Microsoft Red Hat N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable Modbus service, no auth or interaction (PR:N/UI:N), low complexity; impact is availability-only DoS with no confidentiality or integrity effect, giving A:H, C:N, I:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 18:06 vuln.today

CVE Published

Jul 13, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 13, 2026 - 00:00 cve.org

HIGH 7.5

DescriptionCVE.org

A Denial of Service (DoS) vulnerability exists in the receive loop of libmodbus 3.1.12 when running on Windows. The issue stems from improper timeout management during network read operations.

AnalysisAI

Denial of service in libmodbus 3.1.12 on Windows lets remote attackers exhaust or hang a Modbus application by abusing improper timeout handling in the TCP receive loop. Because CWE-400 resource mismanagement occurs during network reads, an unauthenticated peer can stall or crash the availability of Modbus master/slave processes built on the library. No CISA KEV listing exists and EPSS is low (0.15%), but a public gist referenced in the advisory likely carries proof-of-concept material, and CISA SSVC marks the flaw as automatable.

Technical ContextAI

libmodbus is a widely used cross-platform C library implementing the Modbus RTU and Modbus TCP protocols for SCADA/ICS and industrial IoT equipment, acting as the transport layer between masters (clients) and slaves (servers). The defect is classified CWE-400 (Uncontrolled Resource Consumption) and lives in the library's receive loop, where timeout management during socket read operations is handled incorrectly on the Windows platform specifically - likely a difference between Winsock and POSIX select()/recv() timeout semantics. When timeouts are not enforced correctly, a read can block indefinitely or spin, tying up the process. The supplied CPE (cpe:2.3:a:n/a:n/a) is a placeholder and does not identify the product, so affected-component identification relies on the description naming libmodbus 3.1.12 and the upstream GitHub issue (#843).

RemediationAI

No vendor-released patch or fixed tag is identified in the available data at time of analysis - the only upstream reference is issue tracker #843 (https://github.com/stephane/libmodbus/issues/843), not a tagged release, so track that issue and the libmodbus release notes for a patched version before upgrading. Until an official fix ships, apply network-layer compensating controls: restrict inbound access to the Modbus TCP port (default TCP/502) to an allowlist of trusted engineering-workstation IPs via host or perimeter firewall, and segment the ICS/OT network so Windows hosts running libmodbus are never directly reachable from IT or the internet (trade-off: none for legitimate isolated ICS, but breaks remote polling that crosses zones). Where feasible, front the service with a proxy or watchdog that enforces its own read timeout and auto-restarts hung processes, and set explicit application-level response/byte timeouts if the calling code exposes libmodbus timeout APIs. Review VulDB (https://vuldb.com/vuln/378182) and the NVD entry for updated fix information.