AIKIDO-2026-428034

TL;DR

parse_getconfig_msg in the OCPP 1.6 client copies the attacker-controlled JSON key from a GetConfiguration request into a fixed 50-byte stack buffer with unbounded strcpy. The key length is bounded only by the WebSocket receive buffer, so a central system (or MITM on an unencrypted link) that sends an oversized key overflows the OCPP reader thread stack. That yields at least a denial of service and can enable remote code execution depending on build hardening. The fix replaces the copy with a bounded strncpy and explicit NUL termination.