CVE-2026-114408

In Eclipse ThreadX NetX Duo versions 6.4.5.202504 through 6.5.2.202603a, built with IPv6 path MTU discovery, the ICMPv6 Packet Too Big handler uses the destination-table entry it adds without checking that the add succeeded. A sender on the network can fill the destination table with Packet Too B...

CVE-2026-114408 NULL pointer dereference in ICMPv6 Packet Too Big processing when the destination table is full

In Eclipse ThreadX NetX Duo versions 6.4.5.202504 through 6.5.2.202603a, built with IPv6 path MTU discovery, the ICMPv6 Packet Too Big handler uses the destination-table entry it adds without checking that the add succeeded. A sender on the network can fill the destination table with Packet Too B...

CVE-2026-114408

Eclipse ThreadX NetX Duo versions 6.4.5.202504 through 6.5.2.202603a built with IPv6 path MTU discovery are vulnerable to a NULL pointer dereference . The vulnerability exists because the ICMPv6 Packet Too Big handler fails to verify if an entry was successfully added to the destination table. A ...

EUVD-2026-115231

In Eclipse ThreadX NetX Duo versions 6.4.5.202504 through 6.5.2.202603a, built with IPv6 path MTU discovery, the ICMPv6 Packet Too Big handler uses the destination-table entry it adds without checking that the add succeeded. A sender on the network can fill the destination table with Packet Too B...

CVE-2026-93003 NetX Duo Web HTTP server interprets request body content as HTTP header fields

The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A header field name placed in the request body is therefore reported to the server as though it were a header, which lets a client control request framing...

CVE-2026-93003 NetX Duo Web HTTP server interprets request body content as HTTP header fields

The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A header field name placed in the request body is therefore reported to the server as though it were a header, which lets a client control request framing...

CVE-2026-93003 NetX Duo Web HTTP server interprets request body content as HTTP header fields

The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A header field name placed in the request body is therefore reported to the server as though it were a header, which lets a client control request framing...

CVE-2026-93003

The NetX Duo Web HTTP server contains a vulnerability where the HTTP server searches the entire request packet for header fields rather than stopping at the end of the header section. This allows a header field name placed within the request body to be incorrectly reported as a header. Consequent...

CVE-2026-94018 NetX Duo Web HTTP server releases an uninitialized packet pointer on the PUT Content-Length underflow path

The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a Content-Length underflow while processing a PUT request. The condition is reachable by an unauthenticated remote client with a single malformed request...

CVE-2026-94018 NetX Duo Web HTTP server releases an uninitialized packet pointer on the PUT Content-Length underflow path

The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a Content-Length underflow while processing a PUT request. The condition is reachable by an unauthenticated remote client with a single malformed request...

CVE-2026-94018

The NetX Duo Web HTTP server is vulnerable to a memory safety issue where it dereferences and releases an uninitialized pointer . This occurs when the server detects a Content-Length underflow while processing a PUT request. An unauthenticated remote client can trigger this condition by sending a...

CVE-2026-94018 NetX Duo Web HTTP server releases an uninitialized packet pointer on the PUT Content-Length underflow path

The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a Content-Length underflow while processing a PUT request. The condition is reachable by an unauthenticated remote client with a single malformed request...

Eclipse ThreadX – NetX Duo input validation vulnerability

Eclipse ThreadX – NetX Duo 6.5.1.202602 and earlier versions have a vulnerability related to input validation errors. This vulnerability arises because the HTTP server of Web Add-ons scans the entire request packet during the search for header fields, rather than stopping at the end of the header...

Eclipse ThreadX – NetX Duo input validation vulnerability

Eclipse ThreadX – NetX Duo 6.5.1.202602 and earlier versions have a security vulnerability. This vulnerability stems from the X.509 parser in NetX Secure accepting RSA public keys of arbitrary size and decrypting them into a fixed-size buffer. Certificates with larger modulus values may lead to...

Eclipse ThreadX – NetX Duo buffer error vulnerability

Eclipse ThreadX – NetX Duo 6.5.1.202602 and earlier versions have a buffer error vulnerability. This vulnerability stems from the lack of boundary checks in the NetX Secure’s TLS 1.3 Certificate message parser. It may allow malicious TLS 1.3 servers to trigger unsigned integer overflows and heap...

Eclipse ThreadX – NetX Duo: Improper exception handling leads to vulnerabilities

Eclipse ThreadX – The version 6.4.2 to 6.5.1.202602 of NetX Duo contains security vulnerabilities. These vulnerabilities arise from the HTTP server of Web Add-ons detecting a Content-Length overflow when processing PUT requests. This leads to the dereferencing and release of uninitialized pointer...

Eclipse ThreadX – NetX Duo buffer error vulnerability

Eclipse ThreadX – NetX Duo 6.5.1.202602 and earlier versions have a security vulnerability. This vulnerability stems from the NetX Secure’s TLS 1.3 Certificate message parser, which decreases the message length when skipping header fields. It does not confirm whether there are bytes that can be...

NetX Duo 6.5.2.202603 Out-Of-Bounds Read

NetX Duo version 6.5.2.202603 and earlier contains an out-of-bounds read in the SNMP OID parser when processing multi-byte BER lengths...

CVE-2026-103416

Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cache writes past it and on into the rest of the session control block, which holds pointers. A malicious or compromised server can make a TL...

CVE-2026-103416

Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cache writes past it and on into the rest of the session control block, which holds pointers. A malicious or compromised server can make a TL...