CVE-2026-102509: Apache PLC4X denial of service in OPC UA driver

CVE-2026-102509 · Severity: info · Published 2026-09-30

Apache PLC4X is a library for communicating with programmable logic controllers and industrial devices. An attacker who can impersonate an OPC UA server can send malicious messages that cause the client application to exhaust memory or stack space, resulting in a denial of service. The vulnerability is reachable before authentication, making server trust configuration ineffective as a defense.

Technologies: Apache PLC4X. Vendors: Apache.

Quick answers

Is CVE-2026-102509 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-102509 being exploited in the wild.
How severe is CVE-2026-102509?
Informational severity, published 30 September 2026.
Which products and versions are affected?
Apache PLC4X 0.10.0 through 0.13.1.
Is there a fix for CVE-2026-102509?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-102509 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-102509?
Check whether you run Apache PLC4X at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability encompasses multiple resource exhaustion issues in the Java implementation: oversized length-prefixed byte strings allocated before validation, pre-allocated arrays based on untrusted element counts from the wire, accumulated message chunks without size limits, and recursive protocol type parsing without depth limits. The OPC UA driver is vulnerable to pre-authentication exploitation as parsing occurs during secure channel and session establishment before server identity validation. A fix is available in version 1.0.0.

Affected products

  • Apache PLC4X 0.10.0 through 0.13.1

Timeline

  • 2026-09-30: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.