CVE-2026-76992
High
Description
The CODESYS Gateway Client allocates memory based on a size field in a gateway response without enforcing an appropriate upper limit. An unauthenticated remote attacker controlling a malicious gateway can exploit this behavior to trigger excessive memory consumption, resulting in a denial-of-service condition thus leading to a total loss of availablity.
SeverityHigh
CVSS7.5
Exploit probability—
ProductGateway
PublishedSep 30, 2026
First seenSep 30, 2026
Weakness typeCWE-770Allocation of resources without limits
How to fix
Update
- CODESYS Gateway3.5.22.40 or later
- CODESYS Development System 33.5.22.40 or later
- CODESYS Edge Gateway for Windows3.5.22.40 or later
- CODESYS HMI (SL)3.5.22.40 or later
- CODESYS OPC DA Server SL3.5.22.40 or later
- CODESYS PLCHandler3.5.22.40 or later
- CODESYS Runtime Toolkit3.5.22.40 or later
- CODESYS Edge Gateway for Linux4.23.0.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| CODESYS Gateway | 3.0.0.0 ≤ v < 3.5.22.40 | 3.5.22.40 |
| CODESYS Development System 3 | 3.0.0.0 ≤ v < 3.5.22.40 | 3.5.22.40 |
| CODESYS Edge Gateway for Windows | 3.0.0.0 ≤ v < 3.5.22.40 | 3.5.22.40 |
| CODESYS HMI (SL) | 3.0.0.0 ≤ v < 3.5.22.40 | 3.5.22.40 |
| CODESYS OPC DA Server SL | 3.0.0.0 ≤ v < 3.5.22.40 | 3.5.22.40 |
| CODESYS PLCHandler | 3.0.0.0 ≤ v < 3.5.22.40 | 3.5.22.40 |
| CODESYS Runtime Toolkit | 3.0.0.0 ≤ v < 3.5.22.40 | 3.5.22.40 |
| CODESYS Edge Gateway for Linux | 3.15.0.0 ≤ v < 4.23.0.0 | 4.23.0.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.