CVE-2026-102761

NetX Duo's WebSocket client resets the unmasking cursor to the first NXPACKET each time it advances through a chained packet, while the loop's upper bound belongs to the current packet. With the standard contiguous packet-pool layout, a masked server frame split across two packets therefore drive...

CVE-2026-102762

The NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH message. Each malformed PUBLISH costs one packet, or one chain of packets, from the network driver's receive pool, and nothing returns it. A peer that can deliver a few dozen such messages exhausts the pool and stops all inbou...

CVE-2026-102718

hey, nxsnmputilityobjectidget in the NetX Duo SNMP addon does not validate the claimed OID data length against the actual buffer size when the OID uses BER multibyte length encoding, so a remote attacker can send a crafted SNMP packet with a multibyte OID length larger than the available buffer,...

CVE-2026-102718

hey, nxsnmputilityobjectidget in the NetX Duo SNMP addon does not validate the claimed OID data length against the actual buffer size when the OID uses BER multibyte length encoding, so a remote attacker can send a crafted SNMP packet with a multibyte OID length larger than the available buffer,...

CVE-2026-102718

hey, nxsnmputilityobjectidget in the NetX Duo SNMP addon does not validate the claimed OID data length against the actual buffer size when the OID uses BER multibyte length encoding, so a remote attacker can send a crafted SNMP packet with a multibyte OID length larger than the available buffer,...

EUVD-2026-89181

hey, nxsnmputilityobjectidget in the NetX Duo SNMP addon does not validate the claimed OID data length against the actual buffer size when the OID uses BER multibyte length encoding, so a remote attacker can send a crafted SNMP packet with a multibyte OID length larger than the available buffer,...

CVE-2026-102718

The NetX Duo SNMP addon contains a vulnerability in the _nx_snmp_utility_object_id_get function. The component fails to validate the claimed OID data length against the actual buffer size when using BER multibyte length encoding . A remote attacker can send a crafted SNMP packet with an OID lengt...

CVE-2026-102718

hey, nxsnmputilityobjectidget in the NetX Duo SNMP addon does not validate the claimed OID data length against the actual buffer size when the OID uses BER multibyte length encoding, so a remote attacker can send a crafted SNMP packet with a multibyte OID length larger than the available buffer,...

CVE-2026-102762

The NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH message. Each malformed PUBLISH costs one packet, or one chain of packets, from the network driver's receive pool, and nothing returns it. A peer that can deliver a few dozen such messages exhausts the pool and stops all inbou...

EUVD-2026-89171

The NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH message. Each malformed PUBLISH costs one packet, or one chain of packets, from the network driver's receive pool, and nothing returns it. A peer that can deliver a few dozen such messages exhausts the pool and stops all inbou...

CVE-2026-102762

The NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH message. Each malformed PUBLISH costs one packet, or one chain of packets, from the network driver's receive pool, and nothing returns it. A peer that can deliver a few dozen such messages exhausts the pool and stops all inbou...

CVE-2026-102762

The NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH message. Each malformed PUBLISH costs one packet, or one chain of packets, from the network driver's receive pool, and nothing returns it. A peer that can deliver a few dozen such messages exhausts the pool and stops all inbou...

CVE-2026-102762

The NetX Duo MQTT client contains a vulnerability where it leaks packets carrying malformed PUBLISH messages . The underlying cause is that each malformed message consumes one or more packets from the network driver's receive pool without returning them. A peer sending a few dozen such messages c...

EUVD-2026-89210

NetX Duo's WebSocket client resets the unmasking cursor to the first NXPACKET each time it advances through a chained packet, while the loop's upper bound belongs to the current packet. With the standard contiguous packet-pool layout, a masked server frame split across two packets therefore drive...

CVE-2026-102761

NetX Duo's WebSocket client resets the unmasking cursor to the first NXPACKET each time it advances through a chained packet, while the loop's upper bound belongs to the current packet. With the standard contiguous packet-pool layout, a masked server frame split across two packets therefore drive...

CVE-2026-102761

NetX Duo's WebSocket client resets the unmasking cursor to the first NXPACKET each time it advances through a chained packet, while the loop's upper bound belongs to the current packet. With the standard contiguous packet-pool layout, a masked server frame split across two packets therefore drive...

CVE-2026-102761

NetX Duo's WebSocket client resets the unmasking cursor to the first NXPACKET each time it advances through a chained packet, while the loop's upper bound belongs to the current packet. With the standard contiguous packet-pool layout, a masked server frame split across two packets therefore drive...

CVE-2026-102761

The NetX Duo WebSocket client is vulnerable to a memory corruption issue due to an incorrect unmasking cursor reset logic. When processing a chained packet, the client resets the cursor to the first NX_PACKET while the loop's upper bound remains tied to the current packet. In a standard contiguou...

CVE-2026-11576

The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this unified cleanup path unconditionally calls fxfileclose even when the file was never successfully opened. Multiple error branches jump to t...

CVE-2026-11576

The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this unified cleanup path unconditionally calls fxfileclose even when the file was never successfully opened. Multiple error branches jump to t...