CVE-2021-43083: vulnerability in Apache PLC4X
Apache PLC4X 0.9.0 Buffer overflow in PLC4C via crafted server response
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 2.0%
Apache PLC4X - PLC4C (Only the C language implementation was effected) was vulnerable to an unsigned integer underflow flaw inside the tcp transport. Users should update to 0.9.1, which addresses this issue. However, in order to exploit this vulnerability, a user would have to actively connect to a mallicious device which could send a response with invalid content. Currently we consider the probability of this being exploited as quite minimal, however this could change in the future, especially with the industrial networks growing more and more together.
Affected products
Apache Software Foundation · Apache PLC4XRelated CVEs — Apache PLC4X
In the same product, most dangerous first.
CVE-2026-102509HIGHApache PLC4X, Apache PLC4X: Pre-authentication resource exhaustion in the OPC UA driver and the Java SPI parserEPSS 0.4%CVE-2026-102510HIGHApache PLC4X: Go binding: unbounded allocation and framing failures on wire-controlled lengthsEPSS 0.3%CVE-2026-102511HIGHApache PLC4X, Apache PLC4X, Apache PLC4X, Apache PLC4X: ADS discovery accepts spoofed responses and derives the connection target from themEPSS 0.2%CVE-2026-102508CRITICALApache PLC4X: OPC UA secure channel: integrity bypass, unverifiable server certificate, and silent downgradeEPSS 0.2%