9.3
Critical
CVE-2026-103416 Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602…
Description
Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cache writes past it and on into the rest of the session control block, which holds pointers. A malicious or compromised server can make a TLS 1.3 client produce such a message before certificate authentication completes, so no server certificate is needed to reach it.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Eclipse ThreadX - NetX Duo 6.5 | earliest → 6.5.1.202602 | 6.5.2.202603 |
Other CVEs of Eclipse ThreadX - NetX Duo
The 8 CVEs of Eclipse ThreadX - NetX Duo →
CVE-2026-93003
The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of…
6.9
Medium
CVE-2026-92843
A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server…
8.7
High
CVE-2026-92853
The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first…
8.7
High
CVE-2026-94018
The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a `Content-Length`…
8.8
High