Back to overview

CODESYS Gateway Client - Uncontrolled Memory Allocation

VDE-2026-094
Last update
09/30/2026 12:00
Published at
09/30/2026 12:00
Vendor(s)
CODESYS GmbH
External ID
Advisory2026-11_VDE-2026-094
CSAF Document
Download

Summary

The CODESYS Gateway Client (CmpGatewayClient) is used by various CODESYS products to establish PLC communication via the CODESYS Gateway.

Due to missing limits on memory allocations derived from a size field in a gateway response, a malicious gateway can cause excessive memory consumption in the client, resulting in a denial-of-service condition.

The vulnerability can be exploited when an affected product connects to an attacker-controlled gateway.

Impact

Successful exploitation may result in excessive memory consumption, leading to a denial-of-service condition in the affected client.

Affected Product(s)

Model no. Product name Affected versions
CODESYS Development System 3 vers:generic/>=3.0.0.0|<3.5.22.40
CODESYS Edge Gateway for Linux vers:generic/>=3.15.0.0|<4.23.0.0
CODESYS Edge Gateway for Windows vers:generic/>=3.0.0.0|<3.5.22.40
CODESYS Gateway vers:generic/>=3.0.0.0|<3.5.22.40
CODESYS HMI (SL) vers:generic/>=3.0.0.0|<3.5.22.40
CODESYS OPC DA Server SL vers:generic/>=3.0.0.0|<3.5.22.40
CODESYS PLCHandler vers:generic/>=3.0.0.0|<3.5.22.40
CODESYS Runtime Toolkit vers:generic/>=3.0.0.0|<3.5.22.40

Vulnerabilities

Expand / Collapse all

Published
09/30/2026 13:06
Severity
7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
Allocation of Resources Without Limits or Throttling (CWE-770)
Summary

The CODESYS Gateway Client allocates memory based on a size field in a gateway response without enforcing an appropriate upper limit. An unauthenticated remote attacker controlling a malicious gateway can exploit this behavior to trigger excessive memory consumption, resulting in a denial-of-service condition thus leading to a total loss of availablity.

References
cve.org | nvd.nist.gov

Remediation

Update the following products to version 3.5.22.40.
* CODESYS Development System 3
* CODESYS Gateway
* CODESYS Edge Gateway for Windows
* CODESYS HMI (SL)
* CODESYS OPC DA Server SL
* CODESYS PLCHandler
* CODESYS Runtime Toolkit

Update the following product to version 4.23.0.0. The release of this version is expected in Q4 2026.
* CODESYS Edge Gateway for Linux

The CODESYS Development System and the products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download/.

Acknowledgments

CODESYS GmbH thanks the following parties for their efforts:

Revision History

Version Date Summary
1.0.0 09/30/2026 12:00 Initial revision.