CVE-2026-76992: CODESYS Gateway Client DoS Vulnerability

CVE-2026-76992 Overview

CVE-2026-76992 affects the CODESYS Gateway Client, an industrial automation component used to connect engineering tools and runtime systems. The client allocates memory based on a size field taken from a gateway response without enforcing an upper bound. An unauthenticated remote attacker who controls or impersonates a malicious gateway can send crafted responses that force excessive memory allocation. The result is a denial-of-service condition and total loss of availability on the client host. The weakness is tracked as [CWE-770: Allocation of Resources Without Limits or Throttling].

Critical Impact
An unauthenticated attacker controlling a malicious CODESYS gateway can exhaust client memory remotely, producing a full denial-of-service condition on connected engineering or runtime workstations.

Affected Products

CODESYS Gateway Client (see CERT-VDE advisory for version details)
CODESYS engineering and runtime installations that bundle the Gateway Client
Industrial automation environments that connect to CODESYS gateways

Discovery Timeline

2026-09-30 - CVE-2026-76992 published to the National Vulnerability Database
2026-09-30 - Last updated in NVD database
Vendor advisory published by CERT-VDE as CERT-VDE Advisory VDE-2026-094

Technical Details for CVE-2026-76992

Vulnerability Analysis

The CODESYS Gateway Client parses responses from a gateway service and uses an embedded size field to allocate a receive buffer. The client does not validate the declared size against a reasonable maximum or against available system memory. A response advertising an oversized payload therefore causes the client to request very large allocations from the operating system. Repeated or single large allocations exhaust process or system memory and terminate the client or destabilize the host. The impact is limited to availability; the flaw does not directly expose data or allow code execution.

Root Cause

The root cause is missing input validation on a length or size field received from an untrusted network peer. The client trusts the gateway to declare an accurate payload size and passes that value directly to a memory allocation routine. Without a hard cap, sanity check, or streaming read path, the allocator becomes an attacker-controlled sink for memory pressure. This pattern is characteristic of [CWE-770] resource-allocation flaws.

Attack Vector

Exploitation requires network reachability to the CODESYS Gateway Client and the ability to act as, redirect to, or compromise the gateway the client connects to. No authentication and no user interaction are required. An attacker on the same network segment, or one able to spoof or intercept gateway traffic, can send a single crafted response with an inflated size field. The client then attempts the oversized allocation and enters a denial-of-service state.

No verified public exploit code is available. Refer to the CERT-VDE Advisory VDE-2026-094 for vendor technical detail.

Detection Methods for CVE-2026-76992

Indicators of Compromise

Unexpected termination or crashes of CODESYS engineering tools or runtime processes shortly after gateway connections.
Sudden memory-usage spikes on hosts running the CODESYS Gateway Client without corresponding user activity.
Connections from CODESYS clients to gateway endpoints that do not match the documented OT asset inventory.

Detection Strategies

Monitor process memory growth for CODESYS client binaries and alert on rapid allocation beyond a defined baseline.
Inspect network flows between engineering workstations and gateway hosts for unauthorized peers or unexpected response sizes.
Correlate application crash events with preceding gateway session establishment to surface abuse of the size field.

Monitoring Recommendations

Ingest endpoint telemetry from OT engineering workstations into a centralized data lake for cross-host correlation.
Track outbound connections from CODESYS clients on the standard gateway TCP port and alert on new destinations.
Enable crash-dump collection so responders can validate whether termination matches the CVE-2026-76992 allocation pattern.

How to Mitigate CVE-2026-76992

Immediate Actions Required

Restrict network paths so CODESYS Gateway Clients can reach only trusted, inventoried gateway hosts.
Segment engineering workstations and controllers from general IT networks using firewalls or OT DMZs.
Monitor CODESYS client hosts for abnormal memory consumption and unplanned process restarts.
Review the CERT-VDE Advisory VDE-2026-094 and plan upgrades to the fixed release identified by the vendor.

Patch Information

CODESYS distributes fixes through its standard release channel. Consult CERT-VDE Advisory VDE-2026-094 for the affected version list and the patched Gateway Client release. Apply the vendor-supplied update on all engineering workstations and runtime hosts that include the Gateway Client component.

Workarounds

Terminate CODESYS gateway sessions on untrusted networks and require VPN or jump-host access for engineering activities.
Enforce mutual authentication and TLS on gateway communications where the CODESYS deployment supports it.
Limit inbound and outbound traffic on gateway TCP ports to a strict allowlist of engineering hosts.
Disable the Gateway Client on systems that do not require remote engineering connectivity.

bash

# Example host firewall rule limiting CODESYS gateway traffic to a trusted server
# Replace 10.10.20.5 with the authorized gateway address and adjust the port to match the deployment
iptables -A OUTPUT -p tcp -d 10.10.20.5 --dport 1217 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 1217 -j DROP