7.1
High
CVE-2025-2260 In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.3, an attacker can cause a denial of…
Description
In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.3, an attacker can cause a denial of service by specially crafted packets. The core issue is missing closing of a file in case of an error condition, resulting in the 404 error for each further file request. Users can work-around the issue by disabling the PUT request support. This issue follows an incomplete fix of CVE-2025-0726.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| ThreadX 6.4 | earliest → < 6.4.2 | 6.4.2 |
Other CVEs of ThreadX
The 14 CVEs of ThreadX →
CVE-2026-102709
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the four non-secure-callable secure stack functions of the…
8.4
High
CVE-2026-102757
An unprivileged, memory-protected ThreadX module can have the kernel read and write memory at addresses of its choosing,…
8.5
High
CVE-2025-55080
In Eclipse ThreadX before 6.4.3, when memory protection is enabled, syscall parameters verification wasn't enough,…
7.2
High
CVE-2025-55079
In Eclipse ThreadX before version 6.4.3, the thread module has a setting of maximum priority
5.7
Medium