The vulnerability arises from the CODESYS Gateway Client's failure to enforce limits on memory allocation sizes derived from gateway responses. An attacker who can control a malicious gateway can exploit this by sending crafted responses with large size fields, causing the client to allocate excessive memory. This results in a denial-of-service condition due to resource exhaustion. The issue affects versions from 3.0.0.0 up to but not including 3.5.22.40, and from 3.15.0.0 up to but not including 4.23.0.0 of the CODESYS Development System 3.

An unauthenticated remote attacker can exploit this vulnerability to cause excessive memory consumption on the affected system, resulting in denial of service and total loss of availability of the CODESYS Development System 3 Gateway Client.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict access to the CODESYS Gateway Client from untrusted networks and monitor for unusual gateway responses to mitigate exploitation risk.