CVE-2025-34226: OpenPLC Runtime v3 Persistent DoS

Published Oct 3, 2025

Updated

OpenPLC Runtime v3 contains an input validation flaw in the /upload-program-action endpoint: the epochtime field supplied during program uploads is not validated and can be crafted to induce corruption of the programs database. After a successful malformed upload the runtime continues to operate until a restart; on restart the runtime can fail to start because of corrupted database entries, resulting in persistent denial of service requiring complete rebase of the product to recover. This vulnerability was remediated by commit 095ee09.

Affected Software

1 affected component

OpenPLC OpenPLC Runtime

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade OpenPLC Runtime v3 to a version that resolves this vulnerability.
Patch commit 095ee09

Event History

Oct 3, 2025

CVE Published

via MITRE·03:36 PM

Data Sourced

via MITRE·03:36 PM

DescriptionWeakness

Data Sourced

via NVD·04:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-34226?

CVE-2025-34226 has a moderate severity level due to the potential for database corruption from unvalidated input.

How do I fix CVE-2025-34226?

To fix CVE-2025-34226, implement input validation on the epoch_time field in the /upload-program-action endpoint.

What software is affected by CVE-2025-34226?

CVE-2025-34226 specifically affects OpenPLC Runtime v3.

What could happen if CVE-2025-34226 is exploited?

Exploitation of CVE-2025-34226 could lead to corruption of the programs database, resulting in potential system instability.

When was CVE-2025-34226 disclosed?

CVE-2025-34226 was disclosed in 2025.