Eclipse Foundation Eclipse ThreadX - NetX Duo

• CVE-2026-114408 High 8.7 NULL pointer dereference in ICMPv6 Packet Too Big processing when the destination table is full 0.4%
• CVE-2026-93003 Medium 6.9 NetX Duo Web HTTP server interprets request body content as HTTP header fields 0.3%
• CVE-2026-92843 High 8.7 Out-of-bounds Read via the TLS 1.3 Certificate extensions_length in NetX Secure 0.3%
• CVE-2026-92853 High 8.7 Out-of-bounds Read via a Zero-length TLS 1.3 Certificate Message in NetX Secure 0.3%
• CVE-2026-94018 High 8.8 NetX Duo Web HTTP server releases an uninitialized packet pointer on the PUT Content-Length underflow path 0.4%
• CVE-2026-93475 Critical 9.3 Out-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509 0.2%
• CVE-2026-106465 Medium 6.9 Missing HelloVerifyRequest cookie validation in the NetX Secure DTLS server 0.4%
• CVE-2026-106464 High 8.7 Out-of-bounds read via an empty signature BIT STRING in NetX Secure X.509 parsing 0.2%
• CVE-2026-103416 Critical 9.3 Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cache writes past it and on into the rest of 0.2%
• CVE-2026-102730 High 8.6 Out-of-bounds Write via NAND Metadata Parsing at Mount in LevelX 0.1%
• CVE-2026-102727 Medium 6.0 FTP Passive Data Connection Not Bound to the Authenticated Control Peer 0.2%
• CVE-2026-102728 High 7.5 Out-of-bounds reads in NetX Secure client-side handshake parsing (ServerHello and HelloVerifyRequest) 0.2%
• CVE-2026-102726 High 7.1 Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read 0.2%
• CVE-2026-102725 High 7.1 Out-of-bounds Read from Unvalidated MSRP Attribute List Length 0.2%
• CVE-2026-102724 High 7.1 NULL pointer dereference when evicting the last MSRP attribute in a participant's list 0.2%
• CVE-2026-102723 High 7.1 NULL Pointer Dereference on MSRP Attribute Table Exhaustion 0.2%
• CVE-2026-102722 Medium 6.9 The FTP client trusts arbitrary IP addresses in the PASV server response 0.2%
• CVE-2026-102721 Medium 6.9 TFTP client and server copy the ERROR packet message without bounding the read against the packet 0.3%
• CVE-2026-102720 Medium 5.3 DHCP client option walk drifts one byte per skipped option, reading past the received message and past the saved options buffer 0.2%
• CVE-2026-102719 Medium 6.3 NetX Secure DTLS server issues predictable HelloVerifyRequest cookies, so a spoofed client can pass the return-routability check 0.2%
• CVE-2026-102718 High 8.7 Out-of-bounds read in the NetX Duo SNMP OID parser via a multi-byte BER length 0.3%
• CVE-2026-102716 High 8.7 A malformed Session header permanently orphans one packet-pool block per RTSP request 0.3%
• CVE-2026-102715 High 7.1 mDNS string-cache lookup matches on slot size, so a peer name aliases a shorter one and the response encoder writes past the packet 0.3%
• CVE-2026-102714 High 7.1 ICMPv6 option validation accepts a trailing byte residue, sending the Router Advertisement, Neighbor Solicitation, Neighbor Advertisement and Redirect option walkers past the packet or into a permanent loop 0.2%
• CVE-2026-102713 High 8.3 Unbounded DATA datagram in the NetX Duo TFTP server causes an out-of-bounds read and a permanent stall 0.3%
• CVE-2026-102712 Medium 6.3 Out-of-bounds read in the NetX Secure DTLS ClientHello parser 0.3%
• CVE-2026-11576 High 7.5 The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this unified cleanup path unconditionally call 0.5%
• CVE-2025-55102 High 8.7 A denial-of-service vulnerability exists in the NetX IPv6 component functionality of Eclipse ThreadX NetX Duo. A specially crafted network packet of "Packet Too Big" with more than 15 different source 0.4%