CVE-2026-102510

Integer Overflow, Improper Validation of Array Index, Uncontrolled Recursion and Memory Allocation with Excessive Size Value in the Go implementation of Apache PLC4X (PLC4Go) allow a malicious device, or an attacker able to inject network traffic, to crash or exhaust the memory of the client application,<br /> causing a denial of service.<br /> <br /> The individual defects are:<br /> - Generated parsers pre-allocate arrays with the element count claimed on the wire (0.13.0 through 0.13.1).<br /> - Transport read helpers allocate buffers of the size claimed on the wire without an upper bound.<br /> - ADS and KNXnet/IP response handling indexes into received data without checking its length, causing a panic.<br /> - ADS and EIP frame-length handling accepts, or arithmetically wraps to, a length of zero, breaking message framing.<br /> - Recursive protocol types are parsed without a nesting-depth limit. The same defect in the Java implementation is covered by CVE-2026-102509 https://cveprocess.apache.org/cve5/CVE-2026-102509 .<br /> <br /> Additionally, length and position arithmetic in generated serializers was performed in 16-bit integers. If an application forwards attacker-influenced payloads larger than 8 KB, the length field wraps, and the remainder of the payload may be interpreted by the receiving device (for example, an ADS PLC) as <br /> additional, independent protocol messages.<br /> <br /> This issue affects Apache PLC4X: from 0.11.0 before 1.0.0. PLC4Go is consumed as the Go module github.com/apache/plc4x/plc4go; versions refer to the corresponding Apache PLC4X releases.<br /> <br /> Users are recommended to upgrade to version 1.0.0, which fixes the issue.