Apache Software Foundation Apache Plc4X vulnerabilities
4 known vulnerabilities affecting apache_software_foundation/apache_plc4x.
Total CVEs
4
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL1HIGH3
Vulnerabilities
Page 1 of 1
CVE-2026-102508P3CRITICALCVSS 9.2≥ 0.9.0, < 1.0.02026-09-30
CVE-2026-102508 [CRITICAL] CWE-295 CVE-2026-102508: Improper Verification of Cryptographic Signature and Improper Certificate Validation in the OPC UA d
Improper Verification of Cryptographic Signature and Improper Certificate Validation in the OPC UA driver of Apache PLC4X (PLC4J) allows an attacker in a network position between client and server to impersonate the OPC UA server and to read, forge or modify secure-channel traffic, including user credential ssent by the client.
The defect manif
nvd
CVE-2021-43083P3HIGHCVSS 8.8≥ PLC4C, ≤ 0.9.02021-12-19
CVE-2021-43083 [HIGH] CWE-119 CVE-2021-43083: Apache PLC4X - PLC4C (Only the C language implementation was effected) was vulnerable to an unsigned
Apache PLC4X - PLC4C (Only the C language implementation was effected) was vulnerable to an unsigned integer underflow flaw inside the tcp transport. Users should update to 0.9.1, which addresses this issue. However, in order to exploit this vulnerability, a user would have to actively connect to a mallicious device which could send a response with in
nvd
CVE-2026-102509P3HIGHCVSS 8.7≥ 0.11.0, < 1.0.02026-09-30
CVE-2026-102509 [HIGH] CWE-674 CVE-2026-102509: Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits, and Uncontrolle
Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits, and Uncontrolled Recursion in the Java implementation of Apache PLC4X (PLC4J) allow a malicious or impersonated device to exhaust the memory or stack of the client application, causing a denial of service.
In the OPC UA driver these defects are reachable before aut
nvd
CVE-2026-102511P3HIGHCVSS 8.5≥ 0.11.0, < 1.0.0≥ 0.10.0, < 1.0.02026-09-30
CVE-2026-102511 [HIGH] CWE-129 CVE-2026-102511: Improper Verification of Source of a Communication Channel in the ADS discovery of the Go implementa
Improper Verification of Source of a Communication Channel in the ADS discovery of the Go implementation of Apache PLC4X (PLC4Go) allows an attacker able to send UDP datagrams to the discovering host to redirect subsequent connections to an arbitrary, attacker-chosen address. The discovery result's connection
address was derived from the AmsNetId cl
nvd