{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-102511 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-102511 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-102511 is a high-severity server-side request forgery vulnerability in Apache PLC4X, published on 30 Sep 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2026-102511 and fix it if it is affected.\n\nWhat it is: CVE-2026-102511 is a high-severity server-side request forgery vulnerability in Apache PLC4X, published on 30 Sep 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of CVE-2026-102511 in the wild and no public exploit code.\n\nAffected product: Apache PLC4X. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-102511/ (Markdown: https://insights.sbomify.com/CVE-2026-102511/index.md)","id":"CVE-2026-102511","markdown":"https://insights.sbomify.com/CVE-2026-102511/index.md","name":"CVE-2026-102511","record":{"aliases":["GHSA-jfxw-f7pw-76rc"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["data_read","denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":true,"product_category":"Apache PLC4X library","requires_auth":"none","summary":"Attackers can spoof discovery responses to redirect connections to arbitrary hosts or cause denial of service in Apache PLC4X applications using opt-in discovery APIs.","user_interaction":"required","vuln_class":"ssrf"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"apache","cpe":[],"cvss":{"score":8.5,"severity":"high","source":"cna","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-940","name":"Improper Verification of Source of a Communication Channel"},{"id":"CWE-835","name":"Loop with Unreachable Exit Condition"},{"id":"CWE-248","name":"Uncaught Exception"},{"id":"CWE-129","name":"Improper Validation of Array Index"}],"description":"Improper Verification of Source of a Communication Channel in the ADS discovery of the Go implementation of Apache PLC4X (PLC4Go) allows an attacker able to send UDP datagrams to the discovering host to redirect subsequent connections to an arbitrary, attacker-chosen address. The discovery result's connection \naddress was derived from the AmsNetId claimed in the response body rather than from the datagram's actual source address. One spoofed discovery response can therefore insert an inventory entry pointing at any host, including hosts outside the local network, and an application that connects to discovered devices\nwill open its ADS session, including any configured route credentials, to that host.\n\nAdditionally, discovery listeners in both implementations can be disabled by a single malformed datagram:\n- In PLC4Go ADS discovery, a short version block causes a panic that ends the listener for the rest of the discovery call, so legitimate devices answering afterwards are not reported.\n- In PLC4J, the ADS and EtherNet/IP discoverers stop on an unhandled exception from a malformed response.\n- The PLC4J Modbus discoverer can be made to spin indefinitely, consuming a CPU core, by a scanned host that sends a partial response.\n\nExploitation requires the application to invoke the discovery API, which is opt-in, and for the connection redirect, to act on the discovered items.\n\nThis issue affects Apache PLC4X: PLC4Go from 0.11.0 before 1.0.0; PLC4J ADS and Modbus drivers from 0.10.0 before 1.0.0; PLC4J EtherNet/IP driver from 0.11.0 before 1.0.0. PLC4Go is consumed as the Go module github.com/apache/plc4x/plc4go; versions refer to the corresponding Apache PLC4X releases.\n\nUsers are recommended to upgrade to version 1.0.0, which fixes the issue. Version 1.0.0 derives the connection address from the datagram's source address and logs a warning when the claimed AmsNetId disagrees with it.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":null,"headline":"Server-side request forgery in Apache PLC4X","id":"CVE-2026-102511","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"ssrf","year":"2026"},"n_packages":0,"n_references":1,"next":{"headline":"Out-of-bounds write in PeaZip PEA extractor allows code execution via a crafted .pea archive","id":"CVE-2026-102514"},"packages":[],"prev":{"headline":"Apache PLC4X: Go binding: unbounded allocation and framing failures on wire-controlled lengths","id":"CVE-2026-102510"},"products":["Apache PLC4X"],"published":"2026-09-30","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-09-30","vendors":["Apache Software Foundation"]},"summary":"Attackers can spoof discovery responses to redirect connections to arbitrary hosts or cause denial of service in Apache PLC4X applications using opt-in discovery APIs.","url":"https://insights.sbomify.com/CVE-2026-102511/"}