CVE-2026-100403: BACnet Stack: BACnet/SC hub grows its WebSocket reassembly buffer without limit, so a peer can exhaust its memory
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.6, 1.5.2, and 1.6.1, the BACnet/SC hub's Linux WebSocket server reassembles fragmented WebSocket messages into a per-connection fragmentbuffer. It grows that buffer with realloc() on every non-final frame, with no upper bound. A peer that streams binary continuation fragments and never sets FIN keeps the hub reallocating until the box runs out of memory or the process is OOM-killed. The buffer starts at the maximum legal BVLC-SC NPDU size, but nothing after that ties its growth back to that limit. This issue has been patched in versions 1.4.6, 1.5.2, 1.6.1, and 1.7.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.4.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.5.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.6.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.7.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using the BACnet/SC hub's Linux WebSocket server are exposed if they run a release earlier than 1.4.6, 1.5.2, or 1.6.1.
What access does an attacker need?
An attacker needs network access to act as a WebSocket peer of the affected hub. The issue is rated with no required privileges or user interaction.
How can I determine whether a deployment needs remediation?
Check the BACnet Stack version used by the BACnet/SC hub. Versions 1.4.6, 1.5.2, 1.6.1, and 1.7.0 include the patch; earlier affected releases should be upgraded.