Eclipse Threadx Netx Duo

Eclipse WTP HTTP server header injection via request body
CVE-2026-93003 6.9 - Medium - October 20, 2026

The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A header field name placed in the request body is therefore reported to the server as though it were a header, which lets a client control request framing decisions it should not be able to reach.

HTTP Request Smuggling

NetX Secure TLS 1.3 CertMsg Parser UB -> Heap OOB Read (preauth)
CVE-2026-92843 8.7 - High - October 20, 2026

A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-of-bounds read in any peer that processes a remote Certificate message. It is reachable pre-authentication, during the normal handshake, before certificate verification completes.

Out-of-bounds Read

NetX Secure TLS1.3 Cert Parser Buffer Overflow via Zero-Length Message
CVE-2026-92853 8.7 - High - October 20, 2026

The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a byte to skip. A zero-length Certificate message therefore wraps the unsigned length to `0xFFFFFFFF`, which makes the bounds check that follows vacuous and sends the parser reading past the session packet buffer. The trigger is a four-byte handshake header and requires no cryptographic validity. It is reachable pre-authentication.

Out-of-bounds Read

Eclipse Jetty: Uninit Ptr Deref via PUT Content-Length Underflow
CVE-2026-94018 8.8 - High - October 20, 2026

The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a `Content-Length` underflow while processing a `PUT` request. The condition is reachable by an unauthenticated remote client with a single malformed request.

Use of Uninitialized Variable

NetX Secure OOB Write via oversized RSA modulus in X.509 parsing
CVE-2026-93475 9.3 - Critical - October 20, 2026

The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts into fixed-size buffers dimensioned for the `NX_CRYPTO_MAX_RSA_MODULUS_SIZE` default of 4096 bits. A certificate carrying a larger modulus drives an out-of-bounds write past a file-scope static during ordinary certificate-chain verification. It is reachable pre-authentication. The issuer used for the crypto operation is looked up in the remote, peer-supplied store before the trusted store, so the attacker supplies the oversized key themselves as an intermediate in the chain they present. It triggers on a TLS or DTLS client verifying a malicious server's chain, and on a server performing client-certificate authentication.

Memory Corruption

Undefined Behavior in NetX Duo HTTP PUT: Uninitialized File Close
CVE-2026-11576 7.5 - High - June 19, 2026

The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this unified cleanup path unconditionally calls fx_file_close() even when the file was never successfully opened. Multiple error branches jump to the shared cleanup label before any file open operation has occurred, causing fx_file_close() to operate on an uninitialized file handle, leading to undefined behavior, double-close issues, or memory corruption.

Double-free

Eclipse NetX Duo IPv6 'Packet Too Big' DoS Vulnerability
CVE-2025-55102 - January 27, 2026

A denial-of-service vulnerability exists in the NetX IPv6 component functionality of Eclipse ThreadX NetX Duo. A specially crafted network packet of "Packet Too Big" with more than 15 different source address can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.

Resource Exhaustion

NetX Duo HTTP DoS via Missing File Closure before v6.4.3 (Eclipse ThreadX)
CVE-2025-2260 7.5 - High - April 06, 2025

In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.3, an attacker can cause a denial of service by specially crafted packets. The core issue is missing closing of a file in case of an error condition, resulting in the 404 error for each further file request. Users can work-around the issue by disabling the PUT request support. This issue follows an incomplete fix of CVE-2025-0726.

Eclipse ThreadX NetX Duo <6.4.3 HTTP int underflow DoS
CVE-2025-2259 7.5 - High - April 06, 2025

In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.3, an attacker can cause an integer underflow and a subsequent denial of service by writing a very large file, by specially crafted packets with Content-Length in one packet smaller than the data request size of the other packet. A possible workaround is to disable HTTP PUT support. This issue follows an incomplete fix of CVE-2025-0727

NetX Duo HTTP int underflow DOS before v6.4.3
CVE-2025-2258 7.5 - High - April 06, 2025

In NetX Duo component HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.3, an attacker can cause an integer underflow and a subsequent denial of service by writing a very large file, by specially crafted packets with Content-Length smaller than the data request size. A possible workaround is to disable HTTP PUT support. This issue follows an uncomplete fix in CVE-2025-0728.

NetX Duo <6.4.2 HTTP Integer Underflow/DoS
CVE-2025-0728 7.5 - High - February 21, 2025

In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.2, an attacker can cause an integer underflow and a subsequent denial of service by writing a very large file, by specially crafted packets with Content-Length smaller than the data request size. A possible workaround is to disable HTTP PUT support.

NetX Duo <6.4.2 HTTP Server Integer Underflow DoS via PUT
CVE-2025-0727 7.5 - High - February 21, 2025

In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.2, an attacker can cause an integer underflow and a subsequent denial of service by writing a very large file, by specially crafted packets with Content-Length in one packet smaller than the data request size of the other packet. A possible workaround is to disable HTTP PUT support.

NetX Duo <6.4.2 HTTP Server DoS via PUT File Leak
CVE-2025-0726 7.5 - High - February 21, 2025

In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.2, an attacker can cause a denial of service by specially crafted packets. The core issue is missing closing of a file in case of an error condition, resulting in the 404 error for each further file request. Users can work-around the issue by disabling the PUT request support.

ThreadX NetX Duo <6.4.0 Heap Overflow via __portable_aligned_alloc
CVE-2024-2452 9.8 - Critical - March 26, 2024

In Eclipse ThreadX NetX Duo before 6.4.0, if an attacker can control parameters of __portable_aligned_alloc() could cause an integer wrap-around and an allocation smaller than expected. This could cause subsequent heap buffer overflows.

Integer Overflow or Wraparound