Eclipse Threadx - Netx Duo (Eclipse Foundation) - vulnerabilities (CVEs)

8 CVEs, 6 in the last 30 days, 1 known versions, newest CVE from 2026-10-20. Vendor: Eclipse Foundation.

CVEs of Eclipse Threadx - Netx Duo

• CVE-2026-93003 - CVSS 6.9 (medium), 2026-10-20: The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A header field name…
• CVE-2026-92843 - CVSS 8.7 (high), 2026-10-20: A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a…
• CVE-2026-92853 - CVSS 8.7 (high), 2026-10-20: The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a…
• CVE-2026-94018 - CVSS 8.8 (high), 2026-10-20: The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a `Content-Length` underflow while processing a `PUT` request.…
• CVE-2026-93475 - CVSS 9.3 (critical), 2026-10-20: The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts into fixed-size buffers dimensioned for…
• CVE-2026-103416 - CVSS 9.3 (critical), 2026-10-07: Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the…
• CVE-2026-11576 - CVSS 7.5 (high), 2026-06-19: The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this…
• CVE-2025-55102 - CVSS 8.7 (high), 2026-01-27: A denial-of-service vulnerability exists in the NetX IPv6 component functionality of Eclipse ThreadX NetX Duo. A specially crafted network packet of "Packet…