This vulnerability involves a missing release of resources after their effective lifetime (CWE-772) in the CODESYS Modbus TCP Server. Due to a race condition in connection handling, an unauthenticated attacker can exhaust the TCP connection pool by opening connections that are not properly released, leading to denial of service conditions for legitimate users. The vulnerability affects version 1.0.0.0 of CODESYS Modbus. The CVSS 4.0 base score is 8.2, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on availability.

Successful exploitation results in denial of service by exhausting all TCP connections on the affected server, preventing legitimate clients from connecting. There is no indication of data compromise or code execution. The attack can be performed remotely without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been published at this time. Until a patch is available, consider limiting exposure of the affected service to untrusted networks and monitor for unusual connection patterns that may indicate exploitation attempts.