8.7
High
CVE-2026-102716 A malformed Session header permanently orphans one packet-pool block per RTSP request
Description
In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the RTSP server returns a raw parser error for a malformed Session header and never releases the response packet it allocated. An unauthenticated client can drain the server's packet pool with a few dozen requests, stopping the RTSP server and, where the pool is shared, the rest of the network stack until the device restarts.
CVSS 4.0 detail
Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NExploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- Interaction
- None
- Confidentiality
- None
- Integrity
- None
- Availability
- High
- Confidentiality of other systems
- None
- Integrity of other systems
- None
- Availability of other systems
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| eclipse-threadx/netxduo 6.5 | earliest → 6.5.1 | No fix stated |
| Eclipse ThreadX NetX Duo 6.5 | earliest → 6.5.2.202603 | 6.5.2.202603a |
Other CVEs of eclipse-threadx/netxduo
The 3 CVEs of eclipse-threadx/netxduo →
CVE-2026-102720
DHCP client option walk drifts one byte per skipped option, reading past the received message and past the saved options buffer
5.3
Medium
CVE-2026-102715
mDNS string-cache lookup matches on slot size, so a peer name aliases a shorter one and the response encoder writes past the packet
7.1
High