CVE-2026-51539: libmodbus 3.1.12 DoS Vulnerability

CVE-2026-51539 Overview

CVE-2026-51539 is a Denial of Service (DoS) vulnerability in the receive loop of libmodbus version 3.1.12 when running on Windows. The flaw stems from improper timeout management during network read operations. An unauthenticated remote attacker can exploit the issue to exhaust availability of applications that embed the library. The vulnerability is categorized under [CWE-400: Uncontrolled Resource Consumption]. Modbus is widely used in industrial control systems (ICS) and SCADA environments, so DoS conditions in the library can disrupt operational technology (OT) monitoring and control.

Critical Impact
A remote, unauthenticated attacker can trigger a denial of service against Windows applications using libmodbus 3.1.12, potentially disrupting industrial control and monitoring workflows.

Affected Products

libmodbus 3.1.12 on Windows
Applications and services embedding libmodbus 3.1.12 on Windows platforms
Industrial and SCADA integrations relying on the affected library build

Discovery Timeline

2026-07-13 - CVE-2026-51539 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-51539

Vulnerability Analysis

The defect resides in the Modbus receive loop implementation in libmodbus 3.1.12 on Windows. The loop reads bytes from a network socket while enforcing a per-operation timeout. On Windows, the timeout handling does not correctly bound the total time spent waiting for data. As a result, a peer that keeps a connection open but stops sending expected bytes can hold the receive routine indefinitely or force it into repeated wait cycles. This blocks the calling thread and prevents the host application from servicing other Modbus transactions. In industrial environments, blocked polling threads can stall SCADA data acquisition and control logic.

Root Cause

The root cause is improper timeout management ([CWE-400]) in the receive path. The Windows implementation does not reliably decrement or enforce the response and byte timeouts across successive recv calls inside the loop. When a client or server peer delivers partial data or none at all, the loop does not exit within the expected deadline, leading to resource consumption of threads, sockets, and file descriptors owned by the process.

Attack Vector

Exploitation requires only network access to a Modbus TCP endpoint that uses the affected library. No authentication or user interaction is needed. An attacker opens a Modbus TCP session on port 502 (or a custom port), initiates a request, and then withholds or slow-drips response bytes. The receive loop remains blocked, and repeated connections from an attacker can exhaust worker threads or connection slots. See the GitHub Issue #843 Discussion and the GitHub Gist Security Details for reporter-provided reproduction notes.

No verified public exploit code is available. Refer to the linked references for the vulnerability description in prose.

Detection Methods for CVE-2026-51539

Indicators of Compromise

Long-lived Modbus TCP connections that transfer few or no bytes after the initial request
Growth in half-open or idle TCP sessions to port 502 on Windows hosts running libmodbus-based services
Application threads stuck in recv on Modbus sockets, visible in process dumps or performance counters
Increased latency or timeouts reported by SCADA/HMI clients polling affected endpoints

Detection Strategies

Inventory Windows systems running services that link against libmodbus 3.1.12 and flag them for prioritized monitoring
Alert on Modbus TCP flows where connection duration exceeds normal transaction time by an order of magnitude
Correlate SCADA polling failures with concurrent unusual source IPs establishing Modbus sessions

Monitoring Recommendations

Enable network telemetry for TCP port 502 and any custom Modbus ports at the perimeter of OT/ICS segments
Track thread counts and socket handle counts on Windows processes hosting Modbus servers
Log source IPs of Modbus clients and baseline connection rates to detect volumetric abuse

How to Mitigate CVE-2026-51539

Immediate Actions Required

Restrict network reachability of Modbus TCP endpoints to trusted engineering workstations and PLCs using firewall rules
Place affected Windows services behind an ICS-aware gateway that enforces session timeouts independently of libmodbus
Monitor and forcibly terminate Modbus sessions that exceed reasonable inactivity thresholds

Patch Information

No fixed version is listed in the NVD entry at the time of publication. Track the upstream project through the GitHub Issue #843 Discussion for status of a corrected release and apply the vendor-provided update once available.

Workarounds

Deploy a reverse proxy or protocol-aware firewall that enforces a strict read timeout on Modbus TCP sessions
Limit concurrent Modbus connections per source IP to prevent thread exhaustion
Where feasible, run affected services on Linux builds not identified as vulnerable until a Windows patch is available
Segment ICS networks so that Modbus endpoints are not reachable from general-purpose IT networks or the internet

bash

# Example: restrict Modbus TCP (port 502) to a specific management subnet on Windows
New-NetFirewallRule -DisplayName "Modbus TCP - Restrict Inbound" `
    -Direction Inbound -Protocol TCP -LocalPort 502 `
    -RemoteAddress 10.10.20.0/24 -Action Allow

New-NetFirewallRule -DisplayName "Modbus TCP - Block Others" `
    -Direction Inbound -Protocol TCP -LocalPort 502 `
    -Action Block