CVE-2026-102511

Apache PLC4X is vulnerable to an improper verification of source during ADS discovery. In the PLC4Go implementation, an attacker can send spoofed UDP datagrams to force the host to derive connection addresses from the response body's AmsNetId instead of the actual source address. This allows an a...

org.apache.camel.karaf:camel-plc4x (>=4.7.0, <=4.18.4), org.apache.camel.springboot:camel-plc4x-starter (>=4.2.0, <=4.23.0) +12 more potentially affected by CVE-2026-102511 via org.apache.plc4x:plc4j-driver-eip (>=0.11.0, <=0.13.1)

org.apache.plc4x:plc4j-driver-eip MAVEN version =0.11.0, =4.7.0, =4.2.0, =4.2.0, =0.12.0, =0.12.0, =0.12.0, =0.13.0, =0.12.0, =0.11.0, =0.95.0, =0.98.0 - org.connectorio.plc4x.extras.features:org.connectorio.plc4x.extras.feature.decorator 0.12.0 -...

CVE-2026-102511 Apache PLC4X, Apache PLC4X, Apache PLC4X, Apache PLC4X: ADS discovery accepts spoofed responses and derives the connection target from them

Improper Verification of Source of a Communication Channel in the ADS discovery of the Go implementation of Apache PLC4X PLC4Go allows an attacker able to send UDP datagrams to the discovering host to redirect subsequent connections to an arbitrary, attacker-chosen address. The discovery result's...

org.apache.camel.karaf:camel-plc4x (>=4.7.0, <=4.18.4), org.apache.camel.springboot:camel-plc4x-starter (>=3.20.0, <=4.23.0) +13 more potentially affected by CVE-2026-102511 via org.apache.plc4x:plc4j-driver-ads (>=0.10.0, <=0.13.1)

org.apache.plc4x:plc4j-driver-ads MAVEN version =0.10.0, =4.7.0, =3.20.0, =3.20.0, =0.10.0, =0.10.0, =0.12.0, =0.13.0, =0.10.0, =0.10.0, =0.95.0, =0.98.0 - org.connectorio.plc4x.extras.features:org.connectorio.plc4x.extras.feature.decorator 0.12.0 -...

org.apache.camel.karaf:camel-plc4x (>=4.7.0, <=4.18.4), org.apache.camel.springboot:camel-plc4x-starter (>=3.20.0, <=4.23.0) +12 more potentially affected by CVE-2026-102509 via org.apache.plc4x:plc4j-driver-opcua (>=0.10.0, <=0.13.1)

org.apache.plc4x:plc4j-driver-opcua MAVEN version =0.10.0, =4.7.0, =3.20.0, =3.20.0, =0.10.0, =0.10.0, =0.12.0, =0.13.0, =0.10.0, =0.10.0, =0.12.0 - org.connectorio.plc4x.extras.features:org.connectorio.plc4x.extras.feature.decorator 0.12.0 -...

org.apache.camel.karaf:camel-plc4x (>=4.7.0, <=4.18.4), org.apache.camel.springboot:camel-plc4x-starter (>=3.20.0, <=4.23.0) +13 more potentially affected by CVE-2026-102508 via org.apache.plc4x:plc4j-driver-opcua (>=0.9.0, <=0.13.1)

org.apache.plc4x:plc4j-driver-opcua MAVEN version =0.9.0, =4.7.0, =3.20.0, =3.20.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.12.0, =0.13.0, =0.9.0, =0.9.0, =0.12.0 - org.connectorio.plc4x.extras.features:org.connectorio.plc4x.extras.feature.decorator 0.12.0 -...

PT-2026-103084

Name of the Vulnerable Software and Affected Versions Apache PLC4X PLC4Go versions 0.11.0 through 0.9.9 Apache PLC4X PLC4J ADS and Modbus drivers versions 0.10.0 through 0.9.9 Apache PLC4X PLC4J EtherNet/IP driver versions 0.11.0 through 0.9.9 Description Improper verification of the communicatio...

CVE-2026-102511: Improper Verification of Source of a Communication Channel

Improper Verification of Source of a Communication Channel in the ADS discovery of the Go implementation of Apache PLC4X PLC4Go allows an attacker able to send UDP datagrams to the discovering host to redirect subsequent connections to an arbitrary, attacker-chosen address. The discovery result's...

PT-2026-103051

Name of the Vulnerable Software and Affected Versions Apache PLC4X versions 0.9.0 through 0.13.1 Description Improper verification of cryptographic signatures and improper certificate validation in the OPC UA driver PLC4J allow a network attacker to impersonate the OPC UA server. This enables the...

PT-2026-103082

Name of the Vulnerable Software and Affected Versions Apache PLC4X versions 0.10.0 through 0.13.1 Description Memory allocation with excessive size values, allocation of resources without limits, and uncontrolled recursion in the Java implementation of Apache PLC4X PLC4J can allow a malicious or...

org.apache.nifi:nifi-kafka-connector-tests (>=1.14.0, <=1.23.2), org.apache.nifi:nifi-standard-nar (>=1.14.0, <=1.15.3) +4 more potentially affected by CVE-2023-49145 via org.apache.nifi:nifi-jolt-transform-json-ui (>=1.14.0, <=1.23.2)

org.apache.nifi:nifi-jolt-transform-json-ui MAVEN version =1.14.0, =1.14.0, =1.14.0, =1.15.0, =1.14.0, =1.23.2 - org.apache.plc4x:plc4j-nifi-plc4x-nar 0.10.0 - org.apache.plc4x:plc4j-nifi-plc4x-processors 0.10.0 Source cves: CVE-2023-49145 Source advisory: OSV:GHSA-68PR-6FJC-WMGM...

org.apache.nifi:nifi-kafka-connector-tests (>=1.14.0, <=1.23.2), org.apache.nifi:nifi-standard-nar (>=1.14.0, <=1.15.3) +4 more potentially affected by CVE-2023-49145 via org.apache.nifi:nifi-jolt-transform-json-ui (>=1.14.0, <=1.23.2)

org.apache.nifi:nifi-jolt-transform-json-ui MAVEN version =1.14.0, =1.14.0, =1.14.0, =1.15.0, =1.14.0, =1.23.2 - org.apache.plc4x:plc4j-nifi-plc4x-nar 0.10.0 - org.apache.plc4x:plc4j-nifi-plc4x-processors 0.10.0 Source cves: CVE-2023-49145 Source advisory: GHSA-68PR-6FJC-WMGM...