9.3
Critical
CVE-2026-103415 When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without…
Description
When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without checking that the cookie fits in the outgoing packet. Both the length and the contents of that cookie come from the peer, and the write happens before certificate authentication completes, so a malicious or compromised server can overwrite memory past the caller supplied TLS packet buffer without presenting a certificate. Only the client path is affected.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| NetX Duo 6.5 | earliest → 6.5.1.202602 | 6.5.2.202603 |
References
- github.com github.com
- gitlab.eclipse.org gitlab.eclipse.org
Timeline
- Published
- Last modified
Other CVEs of NetX Duo
The 32 CVEs of NetX Duo →
CVE-2026-106465
Missing HelloVerifyRequest cookie validation in the NetX Secure DTLS server
6.9
Medium
CVE-2026-106464
Out-of-bounds read via an empty signature BIT STRING in NetX Secure X.509 parsing
8.7
High
CVE-2026-102717
MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash
7.5
High
CVE-2026-102727
FTP Passive Data Connection Not Bound to the Authenticated Control Peer
6.0
Medium