Eclipse Foundation Threadx Netx Duo vulnerabilities

CVE-2026-103416 Critical · 9.3 CWE-787 Oct 7, 2026

Out-of-bounds Write in Eclipse Foundation Threadx Netx Duo

Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cache writes past it and on into the rest of the session control block, which holds pointers. A malicious or compromised server can make a TLS 1.3 client produce such a message before certificate authentication completes, so no server certificate is needed to reach it.

CVE-2026-11576 High · 7.5 CWE-459 Jun 19, 2026

The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling…

The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this unified cleanup path unconditionally calls fx_file_close() even when the file was never successfully opened. Multiple error branches jump to the shared cleanup label before any file open operation has occurred, causing fx_file_close() to operate on an uninitialized file handle, leading to undefined behavior, double-close issues, or memory corruption.

CVE-2025-55102 High · 7.5 CWE-400 Jan 27, 2026

Uncontrolled Resource Consumption in Eclipse Foundation Threadx Netx Duo

A denial-of-service vulnerability exists in the NetX IPv6 component functionality of Eclipse ThreadX NetX Duo. A specially crafted network packet of "Packet Too Big" with more than 15 different source address can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.

CVE-2025-55086 Critical · 9.8 CWE-125 Oct 20, 2025

Out-of-bounds Read in Eclipse Foundation Threadx Netx Duo

In NetXDuo version before 6.4.4, a networking support module for Eclipse Foundation ThreadX, in the DHCPV6 client there was an unchecked index extracting the server DUID from the server reply. With a crafted packet, an attacker could cause an out of memory read.

CVE-2025-55085 High · 7.5 CWE-125 Oct 17, 2025

Web http client: Unchecked Server-Side Malicious Packet Issue

In NextX Duo before 6.4.4, in the HTTP client module, the network support code for Eclipse Foundation ThreadX, the parsing of HTTP header fields was missing bounds verification. A crafted server response could cause undefined behavior.

CVE-2025-55094 High · 7.5 CWE-125 Oct 17, 2025

Potential out-of-bounds read in _nx_icmpv6_validate_options()

In NetX Duo before 6.4.4, the networking support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _nx_icmpv6_validate_options() when handling a packet with ICMP6 options.

CVE-2025-55087 High · 7.5 CWE-125 Oct 17, 2025

Out-of-bounds Read in Eclipse Foundation Threadx Netx Duo

In NextX Duo's snmp addon versions before 6.4.4, a part of the Eclipse Foundation ThreadX, an attacker could cause an out-of-bound read by a crafted SNMPv3 security parameters.

CVE-2025-55093 Medium · 5.3 CWE-125 Oct 17, 2025

Out of bound read and write in _nx_ipv4_packet_receive() when handling unicast DHCP messages

In NetX Duo before 6.4.4, the networking support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _nx_ipv4_packet_receive() when handling unicast DHCP messages that could cause corruption of 4 bytes of memory.

CVE-2025-55092 Medium · 5.3 CWE-125 Oct 17, 2025

Potential out of bound read in _nx_ipv4_option_process()

In Eclipse Foundation NetX Duo before 6.4.4, the networking support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _nx_ipv4_option_process() when processing an IPv4 packet with the timestamp option.

CVE-2025-55091 Medium · 6.5 CWE-125 Oct 16, 2025

Potential out of bound read in _nx_ip_packet_receive()

In NetX Duo before 6.4.4, the networking support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _nx_ip_packet_receive() function when received an Ethernet with type set as IP but no IP data.

CVE-2025-55090 Medium · 6.5 CWE-125 Oct 16, 2025

Potential out of bound read issue in _nx_ipv4_packet_receive() in NetX Duo

In NetX Duo before 6.4.4, the networking support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _nx_ipv4_packet_receive() function when received an Ethernet frame with less than 4 bytes of IP packet.

CVE-2025-55084 Medium · 5.3 CWE-126 Oct 16, 2025

Out of bound read in _nx_secure_tls_proc_clienthello_supported_versions_extension()

In NetX Duo version before 6.4.4, the component of Eclipse Foundation ThreadX, there was an incorrect bound check in_nx_secure_tls_proc_clienthello_supported_versions_extension() in the extension version field.

CVE-2025-55083 Medium · 5.3 CWE-126 Oct 15, 2025

Broken bounds check in Broken bounds check in _nx_secure_tls_process_clienthello_psk_extension()

In NetX Duo version before 6.4.4, the component of Eclipse Foundation ThreadX, there was an incorrect bound check resulting it out by two out of bound read.

CVE-2025-55082 Medium · 5.3 CWE-125 Oct 15, 2025

Potential out of bound read and info leak in_nx_secure_tls_psk_identity_find()

In NetX Duo version before 6.4.4, the component of Eclipse Foundation ThreadX, there was a potential out of bound read in _nx_secure_tls_process_clienthello() because of a missing validation of PSK length provided in the user message.

CVE-2025-55081 Critical · 9.1 CWE-125 Oct 15, 2025

Potential out of bound read in _nx_secure_tls_process_clienthello()

In Eclipse Foundation NextX Duo before 6.4.4, a module of ThreadX, the _nx_secure_tls_process_clienthello() function was missing length verification of certain SSL/TLS client hello message: the ciphersuite length and compression method length. In case of an attacker-crafted message with values outside of the expected range, it could cause an out-of-bound read.