Executive brief
A denial-of-service vulnerability exists in libmodbus, a library used for communication in industrial control systems. When running on Windows, an attacker can send specially crafted, slow network traffic that causes the software to hang while waiting for data. This prevents the system from processing legitimate commands, potentially disrupting industrial operations or monitoring.
Technical details
A Slowloris-style Denial of Service (DoS) vulnerability exists in libmodbus 3.1.12 when deployed on Windows environments. The flaw is located in the message receive logic within `src/modbus.c`, specifically the `_modbus_receive_msg` function. On Windows, the `select()` system call does not update the `timeval` structure to reflect remaining time after a partial read. Consequently, an unauthenticated remote attacker can send Modbus TCP request fragments at intervals just shorter than the configured timeout, causing the receive loop to reset the timeout window for every byte. This effectively bypasses the global indication timeout, allowing a single connection to block the single-threaded server indefinitely.
Affected products
- libmodbus libmodbus 3.1.12
Timeline
- 2026-07-09: disclosed: Initial discovery and PoC shared via GitHub Gist and issue tracker.
- 2026-07-13: advisory: CVE-2026-51539 published.