EUVD-2026-89679
GHSA-3jwv-g6m6-vg8m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain network position or control malicious PLC
-
DeliverySend crafted ADS/KNXnet/EIP response frame
-
ExploitTrigger over-allocation, panic, or unbounded recursion
-
ExecutionCrash or exhaust PLC4Go client memory
-
ImpactDenial of service of client application
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory allocation limits
|
| Exploitation Conditions | No authentication required (PR:N), but exploitation requires the attacker to be a malicious/compromised PLC device that the PLC4Go client connects to, or to be able to inject/spoof frames on the industrial network path (on-path or same-segment). The vulnerable component is the PLC4Go CLIENT parsing attacker-controlled ADS, KNXnet/IP, or EIP protocol responses - so exposure is limited to deployments where a Go application using github.com/apache/plc4x/plc4go (versions 0.11.0 up to but not including 1.0.0) communicates with untrusted or attacker-reachable industrial endpoints. The secondary 16-bit serializer-wrap defect additionally requires the application to forward attacker-influenced payloads larger than 8KB. Limiting factors: this is not a listening/server-side service exposed to the open internet, impact is denial of service only, and it is confined to the Go implementation. |
| Impact | This is a genuine but availability-only concern. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) confirms remote, unauthenticated, low-complexity attacks with no confidentiality or integrity impact - every listed defect (integer overflow, unbounded array/buffer pre-allocation, unchecked indexing panics, zero-length framing, unbounded recursion) results in a crash or memory exhaustion, i.e. denial of service. The 8.7 score is driven entirely by VA:H combined with the easy network vector; there is no code-execution or data-disclosure component. No EPSS score, KEV listing, SSVC decision, or POC is provided in the input, so exploitation status is: no public exploit identified at time of analysis. A notable nuance is the trust model: the primary threat is a malicious or spoofed PLC/device (or an on-path attacker injecting traffic) crashing the PLC4Go CLIENT, not a server-side exposed service - this limits the exposed attack surface to environments where the Go client talks to untrusted or compromised industrial endpoints. The secondary 16-bit serializer wrap defect could allow attacker-influenced >8KB payloads to be re-interpreted as additional protocol messages by a downstream device (e.g. an ADS PLC), a subtle integrity risk on the device side, but the vendor scored the overall issue as availability-only. Net: real and worth patching for anyone running PLC4Go against untrusted OT networks, but not a widespread internet-facing emergency. |
| Exploit ScenarioDerived | A malicious or compromised PLC (or an attacker able to inject/spoof frames on the industrial network) sends a crafted ADS, KNXnet/IP, or EIP response to a PLC4Go client application. The response claims an enormous element/buffer count, contains a truncated field that is indexed out of bounds, wraps a length field to zero, or nests recursive protocol types without limit - causing the client to over-allocate memory, panic, or exhaust resources and crash. No POC is provided in the input and no authentication is required (PR:N). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Memory exhaustion and parser panics in the Go implementation of Apache PLC4X (PLC4Go) allow a malicious PLC device, or an attacker able to inject or spoof frames on the industrial network path, to crash or exhaust the client application, resulting in denial of service. The flaws affect Go module github.com/apache/plc4x/plc4go from 0.11.0 up to but not including 1.0.0 and include unbounded wire-claimed array and buffer allocations, unchecked indexing of ADS and KNXnet/IP responses, zero-length framing that breaks ADS and EIP message boundaries, unlimited recursion in recursive protocol types, and 16-bit length/position arithmetic in generated serializers that wraps and can cause payloads larger than 8 KB to be mis-framed. CVSS vector indicates no authentication is required (PR:N) and no public exploit has been identified at time of analysis; exploitation is limited to environments where a PLC4Go client talks to untrusted or attacker-reachable industrial endpoints, and impact is availability only.
RemediationAI
Upgrade to Apache PLC4X 1.0.0, which is the vendor-released fix for CVE-2026-102510 (Vendor-released patch: 1.0.0); for Go consumers this means moving the github.com/apache/plc4x/plc4go dependency to the 1.0.0 release and rebuilding, and the advisory at https://lists.apache.org/thread.html/lw66k49p1jf7w0p7h6yg6jqvysborxrs should be reviewed for any additional guidance. Because no vendor patch exists for pre-1.0.0 builds, organizations that cannot immediately upgrade should treat every PLC endpoint the Go client talks to as untrusted: segment the industrial network so PLC4Go clients only reach known-good controllers, and use an industrial firewall or DPI-capable switch to block or rate-limit unexpected ADS, KNXnet/IP, and EIP frame patterns, accepting that aggressive frame filtering can break legitimate vendor traffic and requires protocol-aware tuning. Wrap the client with application-level read deadlines, response-size ceilings, and memory limits so a hostile length claim fails fast rather than allocating, and avoid forwarding attacker-influenced payloads larger than 8 KB through generated serializers until the upgrade is in place, since that is the precondition for the 16-bit length-field wrap; note that artificially capping payload size may reject legitimately large vendor messages. Monitor client processes for runaway memory growth or panic restarts as a detection signal, and confirm whether the separate Java-side recursion issue (CVE-2026-102509) affects any Java PLC4X components in the same environment.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PLC4Go is the Go port of Apache PLC4X, an industrial protocol library whose parsers and serializers are largely generated from protocol specifications and consumed as the Go module github.com/apache/plc4x/plc4go. The root-cause class per the supplied CWE is CWE-789 (Memory Allocation with Excessive Size Value), with the advisory additionally describing Integer Overflow, Improper Validation of Array Index, and Uncontrolled Recursion. In practice the Go code trusts length and element-count fields taken directly from the wire: generated parsers pre-allocate arrays sized by the on-wire element count (0.13.0 through 0.13.1), transport read helpers allocate buffers matching an unbounded on-wire size claim, ADS and KNXnet/IP response handlers index into received data without first confirming the buffer length (triggering a Go runtime panic), ADS and EIP frame-length handling accepts or arithmetically wraps to a zero length and thereby desynchronizes message framing, and recursive protocol types are parsed with no nesting-depth ceiling so a crafted message can drive unbounded recursion and memory growth. A separate serializer defect computes length and position arithmetic in 16-bit integers, so forwarding attacker-influenced payloads larger than 8 KB wraps the length field and can cause the receiving device, for example an ADS PLC, to interpret the trailing bytes as additional independent protocol messages. The same recursion defect in the Java implementation is tracked as CVE-2026-102509, and the affected product is captured by CPE cpe:2.3:a:apache_software_foundation:apache_plc4x:*:*:*:*:*:*:*:*.
Know when Apache Plc4X gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Remote unauthenticated malicious device or injected traffic crashes the client with low complexity; impact is availability-only (crash/memory exhaustion), no confidentiality or integrity loss.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
2DescriptionCVE.org
Integer Overflow, Improper Validation of Array Index, Uncontrolled Recursion and Memory Allocation with Excessive Size Value in the Go implementation of Apache PLC4X (PLC4Go) allow a malicious device, or an attacker able to inject network traffic, to crash or exhaust the memory of the client application, causing a denial of service.
The individual defects are:
- Generated parsers pre-allocate arrays with the element count claimed on the wire (0.13.0 through 0.13.1).
- Transport read helpers allocate buffers of the size claimed on the wire without an upper bound.
- ADS and KNXnet/IP response handling indexes into received data without checking its length, causing a panic.
- ADS and EIP frame-length handling accepts, or arithmetically wraps to, a length of zero, breaking message framing.
- Recursive protocol types are parsed without a nesting-depth limit. The same defect in the Java implementation is covered by CVE-2026-102509 https://cveprocess.apache.org/cve5/CVE-2026-102509 .
Additionally, length and position arithmetic in generated serializers was performed in 16-bit integers. If an application forwards attacker-influenced payloads larger than 8 KB, the length field wraps, and the remainder of the payload may be interpreted by the receiving device (for example, an ADS PLC) as additional, independent protocol messages.
This issue affects Apache PLC4X: from 0.11.0 before 1.0.0. PLC4Go is consumed as the Go module github.com/apache/plc4x/plc4go; versions refer to the corresponding Apache PLC4X releases.
Users are recommended to upgrade to version 1.0.0, which fixes the issue.
Executive ViewAI
Apache PLC4X's Go client library (PLC4Go, versions 0.11.0 up to but not including 1.0.0) can be driven to memory exhaustion or crashed by malicious or spoofed traffic arriving from the industrial endpoints it is built to talk to. Any monitoring, HMI, data-collection, or integration service built on this library - and the operators who depend on it for plant-floor visibility - lose that visibility for as long as the client is down, which is a serious availability concern in OT environments. The flaw is unauthenticated (CVSS PR:N), no public exploit has been identified at time of analysis, and no vendor-released patch is available, so risk must be managed through network and runtime controls until the 1.0.0 release.
No vendor-released patch identified at time of analysis; the exploitation status is no public exploit identified at time of analysis and the vulnerability is unauthenticated (CVSS PR:N), so interim mitigations should be applied. Restrict each PLC4Go client to an explicit allowlist of trusted PLC IP addresses and service ports, and block all other peers on the industrial segment to reduce frame-injection and spoofing reachability. Deploy MAC/IP binding, switch port security, or ICS-aware deep-packet inspection to reject spoofed or malformed frames, and terminate PLC traffic over an authenticated tunnel (TLS/VPN) where the protocol supports it. Enforce process-level memory limits and Go GOMEMLIMIT settings, add a supervisory watchdog that restarts the client on panic or OOM, and alert on repeated restarts or abnormal memory growth. Cap inbound payload sizes at intermediary proxies or brokers where feasible, and monitor upstream Apache PLC4X advisories so the fix can be applied as soon as PLC4Go 1.0.0 is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Apache Plc4X
View allMan-in-the-middle attackers can impersonate the OPC UA server to Apache PLC4X (PLC4J) client applications and read, forg
Denial of service in Apache PLC4X (PLC4J Java) from 0.10.0 before 1.0.0 allows a remote, unauthenticated attacker who ca
Improper verification of the source of ADS discovery responses in Apache PLC4X (CWE-940) allows an attacker on the adjac
Exploit-DB