Skip to contentEclipse Foundation Netx Duo vulnerabilities
- eclipse foundation threadx netx duoNULL pointer dereference in ICMPv6 Packet Too Big processing when the destination table is fullCVE-2026-1144088.7 High
- eclipse foundation threadx - netx duoNetX Duo Web HTTP server interprets request body content as HTTP header fieldsCVE-2026-930036.9 Medium
- eclipse foundation threadx - netx duoOut-of-bounds Read via the TLS 1.3 Certificate extensions_length in NetX SecureCVE-2026-928438.7 High
- eclipse foundation threadx - netx duoNetX Duo Web HTTP server releases an uninitialized packet pointer on the PUT Content-Length underflow pathCVE-2026-940188.8 High
- eclipse foundation threadx - netx duoOut-of-bounds Read via a Zero-length TLS 1.3 Certificate Message in NetX SecureCVE-2026-928538.7 High
- eclipse foundation threadx - netx duoOut-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509CVE-2026-934759.3 Critical
- eclipse foundation threadx netx duoMissing HelloVerifyRequest cookie validation in the NetX Secure DTLS serverCVE-2026-1064656.9 Medium
- eclipse foundation threadx netx duoOut-of-bounds read via an empty signature BIT STRING in NetX Secure X.509 parsingCVE-2026-1064648.7 High
- eclipse foundation netx duoWhen a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without checking that the cookie fits in the outgoing packet. Both the length and the con…CVE-2026-1034159.3 Critical
- eclipse foundation threadx - netx duoOut-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cache writes past it and on into the rest of…CVE-2026-1034169.3 Critical
- eclipse foundation netx duoMQTT WebSocket setter ABI mismatch may disclose memory or cause a crashCVE-2026-1027177.5 High
- eclipse foundation threadx netx duoFTP Passive Data Connection Not Bound to the Authenticated Control PeerCVE-2026-1027276.0 Medium
- eclipse foundation threadx netx duoOut-of-bounds reads in NetX Secure client-side handshake parsing (ServerHello and HelloVerifyRequest)CVE-2026-1027286.3 Medium
- eclipse foundation threadx netx duoUnbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds ReadCVE-2026-1027267.1 High
- eclipse foundation threadx netx duoOut-of-bounds Read from Unvalidated MSRP Attribute List LengthCVE-2026-1027257.1 High
- eclipse foundation threadx netx duoNULL pointer dereference when evicting the last MSRP attribute in a participant's listCVE-2026-1027247.1 High
- eclipse foundation threadx netx duoNULL Pointer Dereference on MSRP Attribute Table ExhaustionCVE-2026-1027237.1 High
- eclipse foundation threadx netx duoThe FTP client trusts arbitrary IP addresses in the PASV server responseCVE-2026-1027226.9 Medium
- eclipse foundation threadx netx duoTFTP client and server copy the ERROR packet message without bounding the read against the packetCVE-2026-1027216.9 Medium
- eclipse foundation threadx netx duoDHCP client option walk drifts one byte per skipped option, reading past the received message and past the saved options bufferCVE-2026-1027205.3 Medium
- eclipse foundation threadx netx duoNetX Secure DTLS server issues predictable HelloVerifyRequest cookies, so a spoofed client can pass the return-routability checkCVE-2026-1027196.3 Medium
- eclipse foundation threadx netx duoOut-of-bounds read in the NetX Duo SNMP OID parser via a multi-byte BER lengthCVE-2026-102718Public exploit8.7 High
- eclipse foundation threadx netx duoA malformed Session header permanently orphans one packet-pool block per RTSP requestCVE-2026-1027168.7 High
- eclipse foundation threadx netx duomDNS string cache accepts a shorter name as a match for a longer stored one, so the known-answer encoder writes past the transmit packetCVE-2026-1027157.1 High
- eclipse foundation threadx netx duoICMPv6 option validation accepts a trailing byte residue, sending the Router Advertisement, Neighbor Solicitation, Neighbor Advertisement and Redirect option walkers past the packet or into a permanen…CVE-2026-1027147.1 High
- eclipse foundation threadx netx duoUnbounded DATA datagram in the NetX Duo TFTP server causes an out-of-bounds read and a permanent stallCVE-2026-1027138.3 High
- eclipse foundation threadx netx duoOut-of-bounds read in the NetX Secure DTLS ClientHello parserCVE-2026-1027126.3 Medium
- eclipse foundation netx duoThe NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH message. Each malformed...CVE-2026-1027628.2 High
- eclipse foundation netx duoNetX Duo's WebSocket client resets the unmasking cursor to the first `NX_PACKET` each time it...CVE-2026-1027619.3 Critical
- eclipse foundation netx duoWhen NetX Secure is built with `NX_SECURE_KEY_CLEAR`, every TLS record sent on an active session...CVE-2026-1027608.3 High
- eclipse foundation netx duoNetX Secure TLS accepts an empty application-data record without verifying its message...CVE-2026-1027596.3 Medium
- eclipse foundation netx duoThe `_nx_secure_x509_asn1_tlv_block_parse()` function parses ASN.1 TLV (tag-length-value) blocks...CVE-2026-1027587.5 High
- eclipse threadx netx duo, eclipse foundation threadx - netx duo +1 moreThe security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this unified cleanup path unconditionally call…CVE-2026-115767.5 High
- eclipse threadx netx duo, eclipse foundation threadx - netx duo +1 moreA denial-of-service vulnerability exists in the NetX IPv6 component functionality of Eclipse ThreadX NetX Duo. A specially crafted network packet of "Packet Too Big" with more than 15 different source…CVE-2025-551028.7 High
- eclipse threadx netx duo, eclipse foundation netx duo +1 moreWeb http client: Unchecked Server-Side Malicious Packet IssueCVE-2025-550858.8 High
- eclipse threadx usbx, eclipse foundation netx duo +1 moreInadequate bounds check and potential underflow in _ux_host_class_hid_report_descriptor_get()CVE-2025-550962.1 Low
- eclipse foundation netx duo, eclipse threadx netx duo +1 morePotential out-of-bounds read in _nx_icmpv6_validate_options()CVE-2025-550946.9 Medium
- eclipse foundation netx duo, eclipse threadx netx duo +1 moreOut of bound read and write in _nx_ipv4_packet_receive() when handling unicast DHCP messagesCVE-2025-550936.9 Medium
- eclipse foundation netx duo, eclipse threadx netx duo +1 morePotential out of bound read in _nx_ipv4_option_process()CVE-2025-550926.9 Medium
- eclipse foundation netx duo, eclipse threadx netx duo +1 morePotential out of bound read in _nx_ip_packet_receive()CVE-2025-550916.9 Medium
- eclipse foundation netx duo, eclipse threadx netx duo +1 morePotential out of bound read issue in _nx_ipv4_packet_receive() in NetX DuoCVE-2025-550906.9 Medium
- eclipse foundation netx duo, eclipse threadx netx duo +1 moreOut of bound read in _nx_secure_tls_proc_clienthello_supported_versions_extension()CVE-2025-550846.9 Medium
- eclipse foundation netx duo, eclipse threadx netx duo +1 moreBroken bounds check in Broken bounds check in _nx_secure_tls_process_clienthello_psk_extension()CVE-2025-550836.9 Medium
- eclipse foundation netx duo, eclipse threadx netx duo +1 morePotential out of bound read and info leak in_nx_secure_tls_psk_identity_find()CVE-2025-550826.9 Medium
- eclipse threadx netx duo, eclipse foundation netx duo +1 morePotential out of bound read in _nx_secure_tls_process_clienthello()CVE-2025-550816.9 Medium