Skip to contentEclipse Foundation Threadx Netx Duo vulnerabilities
- eclipse foundation threadx netx duoNULL pointer dereference in ICMPv6 Packet Too Big processing when the destination table is fullCVE-2026-1144088.7 High
- eclipse foundation threadx netx duoMissing HelloVerifyRequest cookie validation in the NetX Secure DTLS serverCVE-2026-1064656.9 Medium
- eclipse foundation threadx netx duoOut-of-bounds read via an empty signature BIT STRING in NetX Secure X.509 parsingCVE-2026-1064648.7 High
- eclipse foundation threadx netx duoFTP Passive Data Connection Not Bound to the Authenticated Control PeerCVE-2026-1027276.0 Medium
- eclipse foundation threadx netx duoOut-of-bounds reads in NetX Secure client-side handshake parsing (ServerHello and HelloVerifyRequest)CVE-2026-1027286.3 Medium
- eclipse foundation threadx netx duoUnbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds ReadCVE-2026-1027267.1 High
- eclipse foundation threadx netx duoOut-of-bounds Read from Unvalidated MSRP Attribute List LengthCVE-2026-1027257.1 High
- eclipse foundation threadx netx duoNULL pointer dereference when evicting the last MSRP attribute in a participant's listCVE-2026-1027247.1 High
- eclipse foundation threadx netx duoNULL Pointer Dereference on MSRP Attribute Table ExhaustionCVE-2026-1027237.1 High
- eclipse foundation threadx netx duoThe FTP client trusts arbitrary IP addresses in the PASV server responseCVE-2026-1027226.9 Medium
- eclipse foundation threadx netx duoTFTP client and server copy the ERROR packet message without bounding the read against the packetCVE-2026-1027216.9 Medium
- eclipse foundation threadx netx duoDHCP client option walk drifts one byte per skipped option, reading past the received message and past the saved options bufferCVE-2026-1027205.3 Medium
- eclipse foundation threadx netx duoNetX Secure DTLS server issues predictable HelloVerifyRequest cookies, so a spoofed client can pass the return-routability checkCVE-2026-1027196.3 Medium
- eclipse foundation threadx netx duoOut-of-bounds read in the NetX Duo SNMP OID parser via a multi-byte BER lengthCVE-2026-102718Public exploit8.7 High
- eclipse foundation threadx netx duoA malformed Session header permanently orphans one packet-pool block per RTSP requestCVE-2026-1027168.7 High
- eclipse foundation threadx netx duomDNS string cache accepts a shorter name as a match for a longer stored one, so the known-answer encoder writes past the transmit packetCVE-2026-1027157.1 High
- eclipse foundation threadx netx duoICMPv6 option validation accepts a trailing byte residue, sending the Router Advertisement, Neighbor Solicitation, Neighbor Advertisement and Redirect option walkers past the packet or into a permanen…CVE-2026-1027147.1 High
- eclipse foundation threadx netx duoUnbounded DATA datagram in the NetX Duo TFTP server causes an out-of-bounds read and a permanent stallCVE-2026-1027138.3 High
- eclipse foundation threadx netx duoOut-of-bounds read in the NetX Secure DTLS ClientHello parserCVE-2026-1027126.3 Medium