Description
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure TLS client's ServerHello parser and DTLS client's HelloVerifyRequest parser read fields before checking that the message is long enough to contain them. A malicious server or an on-path attacker can make the client read up to three bytes past a handshake message, which can fault the client on targets with memory protection.
Published: 2026-09-29
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 04 Nov 2026 11:00:00 +0000

Type Values Removed Values Added
Description Two client-side TLS/DTLS handshake parsers in NetX Secure read fields from a server-supplied message before validating that the message is long enough to contain them. Both are bounded out-of-bounds reads on a remotely reachable path, both are reached from a TLS or DTLS client connecting to a malicious or malformed server, and both have the same shape: the bounds check exists and returns the correct status, but it runs after the read it is meant to guard. In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure TLS client's ServerHello parser and DTLS client's HelloVerifyRequest parser read fields before checking that the message is long enough to contain them. A malicious server or an on-path attacker can make the client read up to three bytes past a handshake message, which can fault the client on targets with memory protection.
Title Out-of-bounds reads in NetX Secure client-side handshake parsing (ServerHello and HelloVerifyRequest)
Metrics cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Thu, 01 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Title Out-of-Bounds Read in NetX Duo TLS/DTLS Handshake Parsers

Wed, 30 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Eclipse
Eclipse netx Duo
Vendors & Products Eclipse
Eclipse netx Duo

Wed, 30 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 29 Sep 2026 23:00:00 +0000

Type Values Removed Values Added
Title Out-of-Bounds Read in NetX Duo TLS/DTLS Handshake Parsers

Tue, 29 Sep 2026 18:15:00 +0000

Type Values Removed Values Added
Description Two client-side TLS/DTLS handshake parsers in NetX Secure read fields from a server-supplied message before validating that the message is long enough to contain them. Both are bounded out-of-bounds reads on a remotely reachable path, both are reached from a TLS or DTLS client connecting to a malicious or malformed server, and both have the same shape: the bounds check exists and returns the correct status, but it runs after the read it is meant to guard.
Weaknesses CWE-126
References

Subscriptions

Eclipse Netx Duo
cve-icon MITRE

Status: PUBLISHED

Assigner: eclipse

Published:

Updated: 2026-11-04T10:45:44.809Z

Reserved: 2026-09-29T16:15:22.319Z

Link: CVE-2026-102728

cve-icon Vulnrichment

Updated: 2026-09-30T19:35:41.310Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-29T18:17:12.497

Modified: 2026-11-04T11:17:12.590

Link: CVE-2026-102728

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-04T14:30:15Z

Weaknesses