BACNET STACK · CVE-2026-100403 · Package
NO FIX YET · SEE WHAT TO DO
The BACnet/SC hub's Linux WebSocket server keeps growing a per-connection buffer for fragmented messages with no upper limit. A remote peer that sends continuation frames without ever setting FIN can exhaust memory and get the process OOM-killed.
first public Oct 4, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that build or run the BACnet/SC hub on Linux using the BACnet Stack C library are exposed, since the flaw is in the hub's WebSocket server code. Systems using other BACnet components or unaffected release lines can skip it, though the sources do not list which configurations are not exposed.
Not affected if non-hub-deployments
Who cares bacnet, bacnet-sc, c, embedded, linux
git describe in the source tree.1.4.6, 1.5.2, 1.6.1, or 1.7.0, depending on the release line in use.BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.6, 1.5.2, and 1.6.1, the BACnet/SC hub's Linux WebSocket server reassembles fragmented WebSocket messages into a per-connection fragment_buffer. It grows that buffer with realloc() on every non-final frame, with no upper bound. A peer that streams binary continuation fragments and never sets FIN keeps the hub reallocating until the box runs out of memory or the process is OOM-killed. The buffer starts at the maximum legal BVLC-SC NPDU size, but nothing after that ties its growth back to that limit. This issue has been patched in versions 1.4.6, 1.5.2, 1.6.1, and 1.7.0.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.