9.3
Critique
CVE-2026-103415 When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without…
Description
When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without checking that the cookie fits in the outgoing packet. Both the length and the contents of that cookie come from the peer, and the write happens before certificate authentication completes, so a malicious or compromised server can overwrite memory past the caller supplied TLS packet buffer without presenting a certificate. Only the client path is affected.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| NetX Duo 6.5 | premières → 6.5.1.202602 | 6.5.2.202603 |
Références
- github.com github.com
- gitlab.eclipse.org gitlab.eclipse.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de NetX Duo
Les 32 CVE de NetX Duo →
CVE-2026-106465
Missing HelloVerifyRequest cookie validation in the NetX Secure DTLS server
6.9
Moyenne
CVE-2026-106464
Out-of-bounds read via an empty signature BIT STRING in NetX Secure X.509 parsing
8.7
Élevée
CVE-2026-102717
MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash
7.5
Élevée
CVE-2026-102727
FTP Passive Data Connection Not Bound to the Authenticated Control Peer
6.0
Moyenne