CVE-2026-102509: Apache PLC4X: Pre-authentication resource exhaustion in the OPC UA driver and the Java SPI parser

Apache PLC4X's Java implementation (PLC4J) from 0.10.0 through 0.13.1 contains five related resource-exhaustion defects — allocating length-prefixed byte strings from claimed wire lengths before validation, pre-allocating parser lists and collections from attacker-supplied element counts, accumulating OPC UA message chunks without enforcing negotiated limits, and parsing recursive types without a nesting-depth cap. A malicious or impersonated PLC device or OPC UA server can trigger multi-gigabyte allocations or stack exhaustion by sending a single forged length/count field or oversized chunked message, crashing the connecting client application — the impact is denial of service only (CVSS 4.0 8.7, availability-only). Critically, in the OPC UA driver the offending data is parsed while the secure channel and session are still being established, before the server's identity is bound, so configuring a trusted server does not stop an attacker who can impersonate one. Any Java application embedding PLC4X 0.10.0–0.13.1 is affected: the generated-parser defect is shared by all PLC4J drivers, with the OPC UA driver the verified pre-authentication path (chunk-accumulation defect 0.12.0–0.13.1). No public PoC or known exploitation exists and the CVE is not in CISA's KEV catalog; the fix shipped in version 1.0.0, with the analogous Go implementation flaw tracked separately as CVE-2026-102510.