7.5
Élevée
CVE-2026-11576 The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process…
Description
The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this unified cleanup path unconditionally calls fx_file_close() even when the file was never successfully opened. Multiple error branches jump to the shared cleanup label before any file open operation has occurred, causing fx_file_close() to operate on an uninitialized file handle, leading to undefined behavior, double-close issues, or memory corruption.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Eclipse ThreadX - NetX Duo 6.4 | 6.4.2 → 6.5.0.202601 | Pas de correctif indiqué |
Références
- gitlab.eclipse.org gitlab.eclipse.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Eclipse ThreadX - NetX Duo
Les 8 CVE de Eclipse ThreadX - NetX Duo →
CVE-2026-93003
The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of…
6.9
Moyenne
CVE-2026-92843
A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server…
8.7
Élevée
CVE-2026-92853
The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first…
8.7
Élevée
CVE-2026-94018
The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a `Content-Length`…
8.8
Élevée