Description
An unauthenticated remote attacker may exhaust all available TCP connections in the CODESYS Modbus TCP Server stack if a race condition in connection handling is successfully exploited, preventing legitimate clients from establishing new connections.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| CODESYS | CODESYS Modbus | 1.0.0.0 – < 4.6.0.0 | 4.6.0.0 |
Advisories 2
- ADVISORY2026-05_VDE-2026-042 CODESYS Modbus TCP Server - Improper resource management CERT@VDE · May 12, 2026
- WID-SEC-2026-1464 CODESYS Modbus: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · May 11, 2026