CVE-2026-115215
HighCVSS 8.7Summary
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server allocates a session from its fixed session pool for the first datagram from any unrecognised address and port, before the cookie exchange, and never releases a session whose handshake stalls. A remote, unauthenticated attacker can exhaust the pool with one spoofed datagram per source.
Risk Assessment
An attacker can deny DTLS service to legitimate clients until the application resets the sessions, disrupting service availability.
Recommendation
Update Eclipse ThreadX NetX Duo to a patched version and implement mechanisms to reset or limit stalled sessions.
Other vulnerabilities in Eclipse ThreadX NetX Duo
See all- CVE-2026-115403High
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, built with BSD raw socket and IPv6 support, the IPv6 raw send path uses the destination-table entry it adds without checking that the add succeeded. When the destination table is full and an off-link destination is reached through a default router whose neighbour cache entry is unknown, sending on an IPv6 raw socket with header inclusion dereferences a NULL pointer.
- CVE-2026-114408High
In Eclipse ThreadX NetX Duo versions 6.4.5.202504 through 6.5.2.202603a, built with IPv6 path MTU discovery, the ICMPv6 Packet Too Big handler uses the destination-table entry it adds without checking that the add succeeded. A sender on the network can fill the destination table with Packet Too Big messages quoting new destinations, after which the next message makes the IP helper thread dereference a NULL pointer.
- CVE-2026-102714High
The `_nx_icmpv6_validate_options()` function in the Eclipse ThreadX (NetX Duo) network stack scans the ICMPv6 option area with `while (length > 2)`, leaving a one- or two-byte tail unexamined and returning `NX_SUCCESS`. Consumers then re-walk the same area, reading a two-byte option header at the residue and subtracting `nx_icmpv6_option_length << 3` with no zero check and no remaining-length check. This yields three outcomes: an infinite loop (zero length byte), unsigned counter underflow and out-of-buffer reads (non-zero length byte on a short residue), and a one-byte over-read (one-byte residue).
- CVE-2026-103416Critical
Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cache to write past it and into the session control block, which holds pointers. A malicious or compromised server can make a TLS 1.3 client produce such a message before certificate authentication completes, so no server certificate is needed.
- CVE-2026-11576High
The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo introduced a new vulnerability. The shared cleanup path in the HTTP server PUT process calls fx_file_close() even when the file was never opened, leading to undefined behavior, double-close issues, or memory corruption.
Original NVD description (English source)
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server allocates a session from its fixed session pool for the first datagram from any unrecognised address and port, before the cookie exchange, and never releases a session whose handshake stalls. A remote, unauthenticated attacker can exhaust the pool with one spoofed datagram per source and deny DTLS service to legitimate clients until the application resets the sessions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS