Eclipse Jetty: Uninit Ptr Deref via PUT Content-Length Underflow
CVE-2026-94018 Published on October 20, 2026
NetX Duo Web HTTP server releases an uninitialized packet pointer on the PUT Content-Length underflow path
The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a `Content-Length` underflow while processing a `PUT` request. The condition is reachable by an unauthenticated remote client with a single malformed request.
Vulnerability Analysis
CVE-2026-94018 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Types
Use of Uninitialized Variable
The code uses a variable that has not been initialized, leading to unpredictable or unintended results. In some languages such as C and C++, stack variables are not initialized by default. They generally contain junk data with the contents of stack memory before the function was invoked. An attacker can sometimes control or read these contents. In other languages or conditions, a variable that is not explicitly initialized can be given a default value that has security implications, depending on the logic of the program. The presence of an uninitialized variable can sometimes indicate a typographic error in the code.
Access of Uninitialized Pointer
The program accesses or uses a pointer that has not been initialized.
Products Associated with CVE-2026-94018
Want to know whenever a new CVE is published for Eclipse Threadx Netx Duo? stack.watch will email you.
Affected Versions
Eclipse Foundation Eclipse ThreadX - NetX Duo:- Version 6.4.2, <= 6.5.1.202602 is affected.
- Version 6.5.2.202603 is unaffected.