Description
The CODESYS Gateway Client allocates memory based on a size field in a gateway response without enforcing an appropriate upper limit. An unauthenticated remote attacker controlling a malicious gateway can exploit this behavior to trigger excessive memory consumption, resulting in a denial-of-service condition thus leading to a total loss of availablity.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| CODESYS | Development System 3 | 3.0.0.0 – < 3.5.22.40 | 3.5.22.40 |
| CODESYS | Gateway | 3.0.0.0 – < 3.5.22.40 | 3.5.22.40 |
| CODESYS | Edge Gateway for Windows | 3.0.0.0 – < 3.5.22.40 | 3.5.22.40 |
| CODESYS | HMI (SL) | 3.0.0.0 – < 3.5.22.40 | 3.5.22.40 |
| CODESYS | OPC DA Server SL | 3.0.0.0 – < 3.5.22.40 | 3.5.22.40 |
| CODESYS | PLCHandler | 3.0.0.0 – < 3.5.22.40 | 3.5.22.40 |
| CODESYS | Runtime Toolkit | 3.0.0.0 – < 3.5.22.40 | 3.5.22.40 |
| CODESYS | Edge Gateway for Linux | 3.15.0.0 – < 4.23.0.0 | 4.23.0.0 |
Advisories 3
- ADVISORY2026-11_VDE-2026-094 CODESYS Gateway Client - Uncontrolled Memory Allocation CERT@VDE · Oct 22, 2026
- WID-SEC-2026-3710 CODESYS Control Runtime und Gateway Client: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 1, 2026
- WID-SEC-2026-3688 CODESYS Gateway Client: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Sep 30, 2026