Apache PLC4X (Product): news timeline & CVEs

CVE-2026-102511: Apache PLC4X: ADS discovery accepts spoofed responses and derives the connection target from them

Apache PLC4X before 1.0.0 accepts spoofed ADS discovery responses that can redirect connections, CVE-2026-102511.

Apache disclosed CVE-2026-102511 in PLC4X, scored CVSS 4.0 8.5. ADS discovery accepts spoofed responses and derives the connection target from them, described as improper verification of the source of that data. Affected versions are the 0.10.0 and 0.11.0 lines before 1.0.0; Apache PLC4X 1.0.0 is unaffected. The oss-security note does not report exploitation in the wild.

oss-securitySep 30, 09:03 UTC · 8d agoVulnerability 3 sources CVE-2026-102511

CVE-2026-102510: Apache PLC4X: Go binding: unbounded allocation and framing failures on wire-controlled lengths

Apache PLC4X Go bindings before 1.0.0 allow remote denial of service via unbounded allocation on wire-controlled lengths.

Christofer Dutz disclosed CVE-2026-102510 in Apache PLC4X's Go implementation (PLC4Go). Versions 0.11.0 before 1.0.0 are affected, while 1.0.0 is unaffected. Integer overflow, improper array-index validation, uncontrolled recursion, and excessive memory allocation let a malicious device or network attacker cause a high availability impact. CVSS 4.0 is 8.7 (network, no privileges, no user interaction); exploitation is not reported.

oss-securitySep 30, 09:00 UTC · 8d agoVulnerability 3 sources CVE-2026-1025101

CVE-2026-102509: Apache PLC4X: Pre-authentication resource exhaustion in the OPC UA driver and the Java SPI parser

Apache PLC4X Java OPC UA driver and SPI parser before 1.0.0 allow pre-authentication resource exhaustion.

Christofer Dutz disclosed CVE-2026-102509 in Apache PLC4X's Java implementation (PLC4J). Versions 0.10.0 before 1.0.0 are affected, and 1.0.0 is unaffected. Excessive memory allocation, allocation without limits, and uncontrolled recursion in the OPC UA driver and Java SPI parser allow pre-authentication denial of service. CVSS 4.0 is 8.7 with network access and high availability impact only; active exploitation is not reported.

oss-securitySep 30, 08:58 UTC · 8d agoVulnerability 3 sources CVE-2026-102509

CVE-2026-102508: Apache PLC4X: OPC UA secure channel: integrity bypass, unverifiable server certificate, and silent downgrade

Apache PLC4X OPC UA driver before 1.0.0 lets a network attacker impersonate the server and bypass integrity.

Christofer Dutz disclosed CVE-2026-102508 in the OPC UA driver of Apache PLC4X (PLC4J). Versions 0.9.0 before 1.0.0 are affected, while 1.0.0 is unaffected. Improper cryptographic-signature verification and improper certificate validation let an attacker between client and server impersonate the OPC UA server, read traffic, and silently downgrade security. CVSS 4.0 is 9.2 (network, no privileges, high confidentiality, integrity, and availability); observed exploitation is not stated.

oss-securitySep 30, 08:56 UTC · 8d agoVulnerability CVE-2026-1025081

Apache PLC4X

Timeline4 articles

Related CVEsby mentions

Appears with

CVE-2026-102511: Apache PLC4X: ADS discovery accepts spoofed responses and derives the connection target from them

CVE-2026-102510: Apache PLC4X: Go binding: unbounded allocation and framing failures on wire-controlled lengths

CVE-2026-102509: Apache PLC4X: Pre-authentication resource exhaustion in the OPC UA driver and the Java SPI parser

CVE-2026-102508: Apache PLC4X: OPC UA secure channel: integrity bypass, unverifiable server certificate, and silent downgrade