Advisories · Technology

Eclipse Foundation Eclipse ThreadX NetX Duo.

Every CVE that names Eclipse Foundation Eclipse ThreadX NetX Duo among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-114408 CVE record

CVSS 8.7 High

NULL pointer dereference in ICMPv6 Packet Too Big processing when the destination table is full
- Eclipse Foundation Eclipse ThreadX NetX Duo
- Memory corruption
- CWE-252
Not analysed yet 2 Nov 2026
CVE-2026-93003 CVE record

CVSS 6.9 Medium

NetX Duo Web HTTP server interprets request body content as HTTP header fields
- Eclipse Foundation Eclipse ThreadX - NetX Duo
- HTTP request smuggling
Not analysed yet 20 Oct 2026
CVE-2026-92843 CVE record

CVSS 8.7 High

Out-of-bounds Read via the TLS 1.3 Certificate extensions_length in NetX Secure
- Eclipse Foundation Eclipse ThreadX - NetX Duo
- Memory corruption
Not analysed yet 20 Oct 2026
CVE-2026-92853 CVE record

CVSS 8.7 High

Out-of-bounds Read via a Zero-length TLS 1.3 Certificate Message in NetX Secure
- Eclipse Foundation Eclipse ThreadX - NetX Duo
- Memory corruption
Not analysed yet 20 Oct 2026
CVE-2026-94018 CVE record

CVSS 8.8 High

NetX Duo Web HTTP server releases an uninitialized packet pointer on the PUT Content-Length underflow path
- Eclipse Foundation Eclipse ThreadX - NetX Duo
- Memory corruption
Not analysed yet 20 Oct 2026
CVE-2026-93475 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Out-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509
- Eclipse Foundation Eclipse ThreadX - NetX Duo
- Memory corruption
- CWE-1284
Not analysed yet 20 Oct 2026
CVE-2026-106465 CVE record

CVSS 6.9 Medium

Missing HelloVerifyRequest cookie validation in the NetX Secure DTLS server
- Eclipse Foundation Eclipse ThreadX NetX Duo
- Authentication bypass
- CWE-406
Not analysed yet 14 Oct 2026
CVE-2026-106464 CVE record

CVSS 8.7 High

Out-of-bounds read via an empty signature BIT STRING in NetX Secure X.509 parsing
- Eclipse Foundation Eclipse ThreadX NetX Duo
- Memory corruption
Not analysed yet 14 Oct 2026
CVE-2026-103416 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Out-of-bounds write in Eclipse Foundation Eclipse ThreadX - NetX Duo
- Eclipse Foundation Eclipse ThreadX - NetX Duo
- Memory corruption
Not analysed yet 7 Oct 2026
CVE-2026-102730 CVE record

CVSS 8.6 High

Out-of-bounds Write via NAND Metadata Parsing at Mount in LevelX
- Eclipse Foundation Eclipse ThreadX NetX Duo
- Memory corruption
- CWE-1284
Not analysed yet 29 Sept 2026
CVE-2026-102727 CVE record

CVSS 6.0 Medium

FTP Passive Data Connection Not Bound to the Authenticated Control Peer
- Eclipse Foundation Eclipse ThreadX NetX Duo
- CWE-923
Not analysed yet 29 Sept 2026
CVE-2026-102728 CVE record

CVSS 6.3 Medium

Out-of-bounds reads in NetX Secure client-side handshake parsing (ServerHello and HelloVerifyRequest)
- Eclipse Foundation Eclipse ThreadX NetX Duo
- CWE-126
Not analysed yet 29 Sept 2026
CVE-2026-102726 CVE record

CVSS 7.1 High

Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read
- Eclipse Foundation Eclipse ThreadX NetX Duo
- Memory corruption
- Denial of service
Not analysed yet 29 Sept 2026
CVE-2026-102725 CVE record

CVSS 7.1 High

Out-of-bounds Read from Unvalidated MSRP Attribute List Length
- Eclipse Foundation Eclipse ThreadX NetX Duo
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-102724 CVE record

CVSS 7.1 High

NULL pointer dereference when evicting the last MSRP attribute in a participant's list
- Eclipse Foundation Eclipse ThreadX NetX Duo
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-102723 CVE record

CVSS 7.1 High

NULL Pointer Dereference on MSRP Attribute Table Exhaustion
- Eclipse Foundation Eclipse ThreadX NetX Duo
- Memory corruption
- Denial of service
Not analysed yet 29 Sept 2026
CVE-2026-102722 CVE record

CVSS 6.9 Medium

The FTP client trusts arbitrary IP addresses in the PASV server response
- Eclipse Foundation Eclipse ThreadX NetX Duo
- Server-side request forgery (SSRF)
Not analysed yet 29 Sept 2026
CVE-2026-102721 CVE record

CVSS 6.9 Medium

TFTP client and server copy the ERROR packet message without bounding the read against the packet
- Eclipse Foundation Eclipse ThreadX NetX Duo
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-102720 CVE record

CVSS 5.3 Medium

DHCP client option walk drifts one byte per skipped option, reading past the received message and past the saved options buffer
- Eclipse Foundation Eclipse ThreadX NetX Duo
- Memory corruption
- CWE-193
Not analysed yet 29 Sept 2026
CVE-2026-102719 CVE record

CVSS 6.3 Medium

NetX Secure DTLS server issues predictable HelloVerifyRequest cookies, so a spoofed client can pass the return-routability check
- Eclipse Foundation Eclipse ThreadX NetX Duo
- Weak cryptography or TLS
Not analysed yet 29 Sept 2026
CVE-2026-102718 CVE record

CVSS 8.7 High

Out-of-bounds read in the NetX Duo SNMP OID parser via a multi-byte BER length
- Eclipse Foundation Eclipse ThreadX NetX Duo
- Memory corruption
- CWE-130
Not analysed yet 29 Sept 2026
CVE-2026-102716 CVE record

CVSS 8.7 High

A malformed Session header permanently orphans one packet-pool block per RTSP request
- Eclipse Foundation Eclipse ThreadX NetX Duo
- Denial of service
- CWE-755
Not analysed yet 29 Sept 2026
CVE-2026-102715 CVE record

CVSS 7.1 High

mDNS string-cache lookup matches on slot size, so a peer name aliases a shorter one and the response encoder writes past the packet
- Eclipse Foundation Eclipse ThreadX NetX Duo
- Memory corruption
- CWE-697
Not analysed yet 29 Sept 2026
CVE-2026-102714 CVE record

CVSS 7.1 High

ICMPv6 option validation accepts a trailing byte residue, sending the Router Advertisement, Neighbor Solicitation, Neighbor Advertisement and Redirect option walkers past the packet or into a permane…
- Eclipse Foundation Eclipse ThreadX NetX Duo
- Memory corruption
- Denial of service
Not analysed yet 29 Sept 2026
CVE-2026-102713 CVE record

CVSS 8.3 High

Unbounded DATA datagram in the NetX Duo TFTP server causes an out-of-bounds read and a permanent stall
- Eclipse Foundation Eclipse ThreadX NetX Duo
- Memory corruption
- Denial of service
Not analysed yet 29 Sept 2026
CVE-2026-102712 CVE record

CVSS 6.3 Medium

Out-of-bounds read in the NetX Secure DTLS ClientHello parser
- Eclipse Foundation Eclipse ThreadX NetX Duo
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-11576 CVE record

CVSS 7.5 High

Double free in Eclipse Foundation Eclipse ThreadX - NetX Duo
- Eclipse Foundation Eclipse ThreadX - NetX Duo
- Memory corruption
- CWE-459
Not analysed yet 19 Jun 2026
CVE-2025-55102 CVE record

CVSS 8.7 High

Uncontrolled resource consumption in Eclipse Foundation Eclipse ThreadX - NetX Duo
- Eclipse Foundation Eclipse ThreadX - NetX Duo
- Denial of service
Not analysed yet 27 Jan 2026