CVE-2025-1471 Eclipse OMR: Buffer overflow vulnerability

In Eclipse OMR versions 0.2.0 to 0.4.0, some of the z/OS atoe print functions use a constant length buffer for string conversion. If the input format string and arguments are larger than the buffer size then buffer overflow occurs. Beginning in version 0.5.0, the conversion buffers are sized...

CVE-2025-1471

CVE-2025-1471 concerns Eclipse OMR: z/OS atoe print functions using a constant-length buffer from versions 0.2.0–0.4.0, enabling a buffer overflow if input exceeds the buffer. Beginning with 0.5.0, conversion buffers are sized and checked to prevent overflow. Connected sources confirm this CVE ac...

CVE-2025-1471 Eclipse OMR: Buffer overflow vulnerability

In Eclipse OMR versions 0.2.0 to 0.4.0, some of the z/OS atoe print functions use a constant length buffer for string conversion. If the input format string and arguments are larger than the buffer size then buffer overflow occurs. Beginning in version 0.5.0, the conversion buffers are sized...

CVE-2025-1471 Eclipse OMR: Buffer overflow vulnerability

In Eclipse OMR versions 0.2.0 to 0.4.0, some of the z/OS atoe print functions use a constant length buffer for string conversion. If the input format string and arguments are larger than the buffer size then buffer overflow occurs. Beginning in version 0.5.0, the conversion buffers are sized...

CVE-2025-1470 Eclipse OMR: Null pointer dereference vulnerability

In Eclipse OMR, from the initial contribution to version 0.4.0, some OMR internal port library and utilities consumers of z/OS atoe functions do not check their return values for NULL memory pointers or for memory allocation failures. This can lead to NULL pointer dereference crashes. Beginning i...

CVE-2025-1470 Eclipse OMR: Null pointer dereference vulnerability

In Eclipse OMR, from the initial contribution to version 0.4.0, some OMR internal port library and utilities consumers of z/OS atoe functions do not check their return values for NULL memory pointers or for memory allocation failures. This can lead to NULL pointer dereference crashes. Beginning i...

CVE-2025-1470

CVE-2025-1470 affects Eclipse OMR: prior to version 0.5.0, internal OMR port library and z/OS atoe function consumers did not properly check NULL pointers or allocation failures, risking NULL pointer dereferences. Beginning with 0.5.0, OMR consumers handle NULL return values and memory allocation...

CVE-2025-1470 Eclipse OMR: Null pointer dereference vulnerability

In Eclipse OMR, from the initial contribution to version 0.4.0, some OMR internal port library and utilities consumers of z/OS atoe functions do not check their return values for NULL memory pointers or for memory allocation failures. This can lead to NULL pointer dereference crashes. Beginning i...

CVE-2025-0727

In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.2, an attacker can cause an integer underflow and a subsequent denial of service by writing a very large file, by specially crafted packets with Content-Length in one packet smaller than the data request size of the...

CVE-2025-0727 Eclipse ThreadX NetX Duo HTTP server single PUT request integer underflow

In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.2, an attacker can cause an integer underflow and a subsequent denial of service by writing a very large file, by specially crafted packets with Content-Length in one packet smaller than the data request size of the...

CVE-2025-0727

The CVE-2025-0727 entry concerns Eclipse ThreadX NetX Duo NetX HTTP server that allows an attacker to trigger an integer underflow and DoS by sending crafted HTTP PUT requests with mismatched Content-Length. Affected: NetX Duo before version 6.4.2 (per CVE-0727); related follow-ups indicate an in...

CVE-2025-0727 Eclipse ThreadX NetX Duo HTTP server single PUT request integer underflow

In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.2, an attacker can cause an integer underflow and a subsequent denial of service by writing a very large file, by specially crafted packets with Content-Length in one packet smaller than the data request size of the...

CVE-2025-0728 Eclipse ThreadX NetX Duo HTTP server single PUT request integer underflow

In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.2, an attacker can cause an integer underflow and a subsequent denial of service by writing a very large file, by specially crafted packets with Content-Length smaller than the data request size. A possible workaroun...

CVE-2025-0728

The CVE-2025-0728 issue affects the NetX HTTP server in Eclipse ThreadX NetX Duo prior to version 6.4.2. A crafted network packet with Content-Length smaller than the data can trigger an integer underflow in the HTTP PUT path, leading to a denial of service. A workaround is to disable HTTP PUT su...

CVE-2025-0728 Eclipse ThreadX NetX Duo HTTP server single PUT request integer underflow

In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.2, an attacker can cause an integer underflow and a subsequent denial of service by writing a very large file, by specially crafted packets with Content-Length smaller than the data request size. A possible workaroun...

CVE-2025-0728 Eclipse ThreadX NetX Duo HTTP server single PUT request integer underflow

In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.2, an attacker can cause an integer underflow and a subsequent denial of service by writing a very large file, by specially crafted packets with Content-Length smaller than the data request size. A possible workaroun...

CVE-2025-0726

In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.2, an attacker can cause a denial of service by specially crafted packets. The core issue is missing closing of a file in case of an error condition, resulting in the 404 error for each further file request. Users ca...

CVE-2025-0726 Eclipse ThreadX NetX Duo HTTP server denial of service

In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.2, an attacker can cause a denial of service by specially crafted packets. The core issue is missing closing of a file in case of an error condition, resulting in the 404 error for each further file request. Users ca...

CVE-2025-0726 Eclipse ThreadX NetX Duo HTTP server denial of service

In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.2, an attacker can cause a denial of service by specially crafted packets. The core issue is missing closing of a file in case of an error condition, resulting in the 404 error for each further file request. Users ca...

CVE-2025-0726

The CVE-2025-0726 family affects Eclipse ThreadX NetX Duo’s NetX HTTP server. A vulnerability in the HTTP server functionality (NetX) — prior to 6.4.2 for CVE-2025-0726 and prior to 6.4.3 for CVE-2025-2260 — arises from a missing closure of a file when an error occurs, causing a denial of service...