Eclipse Foundation Eclipse Threadx Netx Duo vulnerabilities

3 vulnerabilities

Known vulnerabilities in Eclipse Foundation Eclipse Threadx Netx Duo, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

8.7CVE-2025-55102eclipse foundationeclipse threadx - netx duo+1
EPSS score
0.40%
A denial-of-service vulnerability exists in the NetX IPv6 component functionality of Eclipse ThreadX NetX Duo. A specially crafted network packet of "Packet Too Big" with more than 15 different source address can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.7.5CVE-2026-11576eclipse foundationeclipse threadx - netx duo+1
EPSS score
0.46%
The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this unified cleanup path unconditionally calls fx_file_close() even when the file was never successfully opened. Multiple error branches jump to the shared cleanup label before any file open operation has occurred, causing fx_file_close() to operate on an uninitialized file handle, leading to undefined behavior, double-close issues, or memory corruption.9.3CVE-2026-103416eclipse foundationeclipse threadx - netx duo
EPSS score
0.21%
Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cache writes past it and on into the rest of the session control block, which holds pointers. A malicious or compromised server can make a TLS 1.3 client produce such a message before certificate authentication completes, so no server certificate is needed to reach it.