PLC4J (Product): news timeline & CVEs

CVE-2026-102509: Apache PLC4X: Pre-authentication resource exhaustion in the OPC UA driver and the Java SPI parser

Apache PLC4X Java OPC UA driver and SPI parser before 1.0.0 allow pre-authentication resource exhaustion.

Christofer Dutz disclosed CVE-2026-102509 in Apache PLC4X's Java implementation (PLC4J). Versions 0.10.0 before 1.0.0 are affected, and 1.0.0 is unaffected. Excessive memory allocation, allocation without limits, and uncontrolled recursion in the OPC UA driver and Java SPI parser allow pre-authentication denial of service. CVSS 4.0 is 8.7 with network access and high availability impact only; active exploitation is not reported.

oss-securitySep 30, 08:58 UTC · 8d agoVulnerability 3 sources CVE-2026-102509

CVE-2026-102508: Apache PLC4X: OPC UA secure channel: integrity bypass, unverifiable server certificate, and silent downgrade

Apache PLC4X OPC UA driver before 1.0.0 lets a network attacker impersonate the server and bypass integrity.

Christofer Dutz disclosed CVE-2026-102508 in the OPC UA driver of Apache PLC4X (PLC4J). Versions 0.9.0 before 1.0.0 are affected, while 1.0.0 is unaffected. Improper cryptographic-signature verification and improper certificate validation let an attacker between client and server impersonate the OPC UA server, read traffic, and silently downgrade security. CVSS 4.0 is 9.2 (network, no privileges, high confidentiality, integrity, and availability); observed exploitation is not stated.

oss-securitySep 30, 08:56 UTC · 8d agoVulnerability CVE-2026-1025081

PLC4J

Timeline2 articles

Related CVEsby mentions

Appears with

CVE-2026-102509: Apache PLC4X: Pre-authentication resource exhaustion in the OPC UA driver and the Java SPI parser

CVE-2026-102508: Apache PLC4X: OPC UA secure channel: integrity bypass, unverifiable server certificate, and silent downgrade