Skip to content
fr Sign in
6.9 Medium

CVE-2026-93003 The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of…

Description

The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A header field name placed in the request body is therefore reported to the server as though it were a header, which lets a client control request framing decisions it should not be able to reach.

Affected products and versions

Product Affected versions Fixed in
Eclipse ThreadX - NetX Duo 6.5 earliest → 6.5.1.202602 6.5.2.202603

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Eclipse ThreadX - NetX Duo

The 8 CVEs of Eclipse ThreadX - NetX Duo →
CVE-2026-92843 A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server… 8.7 High CVE-2026-92853 The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first… 8.7 High CVE-2026-94018 The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a `Content-Length`… 8.8 High CVE-2026-93475 The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts… 9.3 Critical
Track this CVE