9.3
Critique
CVE-2026-93475 The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts…
Description
The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts into fixed-size buffers dimensioned for the `NX_CRYPTO_MAX_RSA_MODULUS_SIZE` default of 4096 bits. A certificate carrying a larger modulus drives an out-of-bounds write past a file-scope static during ordinary certificate-chain verification. It is reachable pre-authentication. The issuer used for the crypto operation is looked up in the remote, peer-supplied store before the trusted store, so the attacker supplies the oversized key themselves as an intermediate in the chain they present. It triggers on a TLS or DTLS client verifying a malicious server's chain, and on a server performing client-certificate authentication.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Eclipse ThreadX - NetX Duo 6.5 | premières → 6.5.1.202602 | 6.5.2.202603 |
Références
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Eclipse ThreadX - NetX Duo
Les 8 CVE de Eclipse ThreadX - NetX Duo →
CVE-2026-93003
The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of…
6.9
Moyenne
CVE-2026-92843
A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server…
8.7
Élevée
CVE-2026-92853
The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first…
8.7
Élevée
CVE-2026-94018
The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a `Content-Length`…
8.8
Élevée