CVE-2026-102510: Apache PLC4X: Go binding: unbounded allocation and framing failures on wire-controlled lengths

The Go implementation of Apache PLC4X (PLC4Go) contains multiple parsing and serialization defects — integer overflow, missing array-index validation, uncontrolled recursion, and wire-controlled memory allocation — that let a malicious PLC/device or an attacker who can inject traffic on the industrial protocol connection crash or exhaust the memory of the client application, causing denial of service. Specific triggers include response frames claiming huge element counts or buffer sizes, ADS/KNXnet/IP responses shorter than the offsets indexed into them, ADS and EtherNet/IP frame lengths of zero or values that wrap to zero, and recursively nested protocol types with no depth limit. A separate 16-bit length/position arithmetic bug in generated serializers means that if an application forwards attacker-influenced payloads larger than 8 KB, the length field wraps and the remainder can be interpreted by the receiving device (for example, a Beckhoff ADS PLC) as additional independent protocol messages — a potential integrity risk beyond simple DoS. Affected software is anything embedding the Go module github.com/apache/plc4x/plc4go at versions 0.11.0 through 0.13.x; the fix is version 1.0.0. There is no known public PoC and no indication of exploitation in the wild.