CVE-2025-34226 OpenPLC Runtime v3 Persistent DoS
Attackers can cause persistent denial of service in OpenPLC Runtime by uploading malformed program data that corrupts the database, preventing restarts.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-34226?
CVE-2025-34226 is a high-severity denial of service vulnerability in Autonomy Logic OpenPLC Runtime, published on 3 Oct 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
OpenPLC Runtime v3 contains an input validation flaw in the /upload-program-action endpoint: the epoch_time field supplied during program uploads is not validated and can be crafted to induce corruption of the programs database. After a successful malformed upload the runtime continues to operate until a restart; on restart the runtime can fail to start because of corrupted database entries, resulting in persistent denial of service requiring complete rebase of the product to recover. This vulnerability was remediated by commit 095ee09.
Which versions are affected by CVE-2025-34226?
How do I fix CVE-2025-34226?
No fix has been published for CVE-2025-34226 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-34226 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-34226 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-qjpv-g9fx-fc98.