Is CVE-2026-51535 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-51535 being exploited in the wild.

How severe is CVE-2026-51535?

Informational severity, with a CVSS score of 7.5, published 8 July 2026.

Which products and versions are affected?

EIPStackGroup OpENer 2.3.0 (commit 76b95cf).

Is there a fix for CVE-2026-51535?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-51535 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-51535?

Check whether you run EIPStackGroup OpENer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-51535: EIPStackGroup OpENer resource exhaustion in TCP Network Handler

CVE-2026-51535 · Severity: info · CVSS 7.5 · Published 2026-07-08

OpENer is an open-source implementation of the EtherNet/IP industrial protocol used in manufacturing and automation devices. A vulnerability allows a remote attacker to crash or freeze the communication service by sending a single, incomplete network message. This prevents legitimate controllers and workstations from communicating with the device, potentially disrupting industrial operations.

Technologies: EIPStackGroup OpENer. Vendors: EIPStackGroup.

Quick answers

Is CVE-2026-51535 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-51535 being exploited in the wild.
How severe is CVE-2026-51535?: Informational severity, with a CVSS score of 7.5, published 8 July 2026.
Which products and versions are affected?: EIPStackGroup OpENer 2.3.0 (commit 76b95cf).
Is there a fix for CVE-2026-51535?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-51535 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-51535?: Check whether you run EIPStackGroup OpENer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Slowloris-style Denial of Service (DoS) vulnerability exists in the TCP Network Handler of OpENer 2.3.0 (specifically within generic_networkhandler.c). The root cause is the use of a single-threaded event loop combined with blocking socket reads. When a new TCP connection is accepted, the socket is not set to non-blocking mode. An attacker can send a partial EtherNet/IP (ENIP) header specifying a large data size and then withhold the remaining payload. This causes the 'recv' call in 'HandleDataOnTcpSocket' to block indefinitely, stalling the 'NetworkHandlerProcessCyclic' loop and preventing the processing of any other legitimate network traffic. The attack requires only a single unauthenticated TCP connection to port 44818.

Affected products

EIPStackGroup OpENer 2.3.0 (commit 76b95cf)

Timeline

2026-04-23: disclosed: Issue reported on GitHub by MrAlaskan
2026-07-03: advisory: Detailed security advisory published via GitHub Gist
2026-07-08: disclosed: CVE-2026-51535 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.