Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
6 vulnerabilities found for eclipse-threadx/netxduo by Eclipse Foundation
CVE-2026-102720 (GCVE-0-2026-102720)
Vulnerability from nvd – Published: 2026-09-29 17:46 – Updated: 2026-09-29 18:37
VLAI
EPSS
VEX
Summary
A DHCP server, or anyone on the LAN who answers a DISCOVER first, can make the client read about a
kilobyte past the end of the received message.
The option walk keeps a pointer and an offset in step, and the only bound check uses the offset:
```c
/* addons/dhcp/nxd_dhcp_client.c:7538, 7572 */
while (i < length - 1)
{
...
size = *(++data); /* data moves 1: type -> length byte */
data += size + 1; /* data moves size + 1 more */
i += size + 1; /* i moves only size + 1 */
}
```
A TLV option occupies size + 2 bytes. `data` is advanced by size + 2 in total, `i` by size + 1, so
the offset falls one byte behind the real read position for every option the walk skips. After
enough skipped options the check `i < length - 1` still holds while `data` is already past the end
of the message, and the subsequent read of the type and length bytes comes from whatever follows.
A single OFFER carrying a long run of skippable options is enough:
```
ERROR: AddressSanitizer: heap-buffer-overflow
READ of size 1 at 0x61b000000794 thread T5
#0 _nx_dhcp_search_buffer addons/dhcp/nxd_dhcp_client.c:7541
#1 _nx_dhcp_get_option_value addons/dhcp/nxd_dhcp_client.c:7082
0x61b000000794 is located 164 bytes to the right of 1648-byte region
```
A well formed OFFER through the same path is handled normally, the client records the offer and
moves to REQUESTING, so the difference is the option layout rather than the harness.
The read runs in the DHCP client thread while the client is still unconfigured, so it happens on
every boot in reach of a hostile DHCP responder. The values read are used to configure the
interface, which is how the disclosed bytes become observable.
Advance `i` by size + 2, or derive the bound from `data` rather than keeping a second counter.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 18:36 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Eclipse Foundation | eclipse-threadx/netxduo |
Affected:
0 , ≤ 6.5.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102720",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T18:36:33.534376Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T18:37:07.341Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "eclipse-threadx/netxduo",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "6.5.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "L0stHeart"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA DHCP server, or anyone on the LAN who answers a DISCOVER first, can make the client read about a\u003c/p\u003e\u003cp\u003ekilobyte past the end of the received message.\u003c/p\u003e\u003cp\u003eThe option walk keeps a pointer and an offset in step, and the only bound check uses the offset:\u003c/p\u003e\u003cp\u003e```c\u003c/p\u003e\u003cp\u003e/* addons/dhcp/nxd_dhcp_client.c:7538, 7572 */\u003c/p\u003e\u003cp\u003ewhile (i \u0026lt; length - 1)\u003c/p\u003e\u003cp\u003e{\u003c/p\u003e\u003ccode\u003e ...\u003c/code\u003e\u003cbr\u003e\u003ccode\u003e size = *(++data); /* data moves 1: type -\u0026gt; length byte */\u003c/code\u003e\u003cbr\u003e\u003ccode\u003e data += size + 1; /* data moves size + 1 more */\u003c/code\u003e\u003cbr\u003e\u003ccode\u003e i += size + 1; /* i moves only size + 1 */\u003c/code\u003e\u003cbr\u003e\u003cp\u003e}\u003c/p\u003e\u003cp\u003e```\u003c/p\u003e\u003cp\u003eA TLV option occupies size + 2 bytes. `data` is advanced by size + 2 in total, `i` by size + 1, so\u003c/p\u003e\u003cp\u003ethe offset falls one byte behind the real read position for every option the walk skips. After\u003c/p\u003e\u003cp\u003eenough skipped options the check `i \u0026lt; length - 1` still holds while `data` is already past the end\u003c/p\u003e\u003cp\u003eof the message, and the subsequent read of the type and length bytes comes from whatever follows.\u003c/p\u003e\u003cp\u003eA single OFFER carrying a long run of skippable options is enough:\u003c/p\u003e\u003cp\u003e```\u003c/p\u003e\u003cp\u003eERROR: AddressSanitizer: heap-buffer-overflow\u003c/p\u003e\u003cp\u003eREAD of size 1 at 0x61b000000794 thread T5\u003c/p\u003e\u003ccode\u003e #0 _nx_dhcp_search_buffer addons/dhcp/nxd_dhcp_client.c:7541\u003c/code\u003e\u003cbr\u003e\u003ccode\u003e #1 _nx_dhcp_get_option_value addons/dhcp/nxd_dhcp_client.c:7082\u003c/code\u003e\u003cbr\u003e\u003cp\u003e0x61b000000794 is located 164 bytes to the right of 1648-byte region\u003c/p\u003e\u003cp\u003e```\u003c/p\u003e\u003cp\u003eA well formed OFFER through the same path is handled normally, the client records the offer and\u003c/p\u003e\u003cp\u003emoves to REQUESTING, so the difference is the option layout rather than the harness.\u003c/p\u003e\u003cp\u003eThe read runs in the DHCP client thread while the client is still unconfigured, so it happens on\u003c/p\u003e\u003cp\u003eevery boot in reach of a hostile DHCP responder. The values read are used to configure the\u003c/p\u003e\u003cp\u003einterface, which is how the disclosed bytes become observable.\u003c/p\u003e\u003cp\u003eAdvance `i` by size + 2, or derive the bound from `data` rather than keeping a second counter.\u003c/p\u003e"
}
],
"value": "A DHCP server, or anyone on the LAN who answers a DISCOVER first, can make the client read about a\n\n\n\nkilobyte past the end of the received message.\n\n\n\nThe option walk keeps a pointer and an offset in step, and the only bound check uses the offset:\n\n\n\n```c\n\n\n\n/* addons/dhcp/nxd_dhcp_client.c:7538, 7572 */\n\n\n\nwhile (i \u003c length - 1)\n\n\n\n{\n\n ...\n size = *(++data); /* data moves 1: type -\u003e length byte */\n data += size + 1; /* data moves size + 1 more */\n i += size + 1; /* i moves only size + 1 */\n\n\n}\n\n\n\n```\n\n\n\nA TLV option occupies size + 2 bytes. `data` is advanced by size + 2 in total, `i` by size + 1, so\n\n\n\nthe offset falls one byte behind the real read position for every option the walk skips. After\n\n\n\nenough skipped options the check `i \u003c length - 1` still holds while `data` is already past the end\n\n\n\nof the message, and the subsequent read of the type and length bytes comes from whatever follows.\n\n\n\nA single OFFER carrying a long run of skippable options is enough:\n\n\n\n```\n\n\n\nERROR: AddressSanitizer: heap-buffer-overflow\n\n\n\nREAD of size 1 at 0x61b000000794 thread T5\n\n #0 _nx_dhcp_search_buffer addons/dhcp/nxd_dhcp_client.c:7541\n #1 _nx_dhcp_get_option_value addons/dhcp/nxd_dhcp_client.c:7082\n\n\n0x61b000000794 is located 164 bytes to the right of 1648-byte region\n\n\n\n```\n\n\n\nA well formed OFFER through the same path is handled normally, the client records the offer and\n\n\n\nmoves to REQUESTING, so the difference is the option layout rather than the harness.\n\n\n\nThe read runs in the DHCP client thread while the client is still unconfigured, so it happens on\n\n\n\nevery boot in reach of a hostile DHCP responder. The values read are used to configure the\n\n\n\ninterface, which is how the disclosed bytes become observable.\n\n\n\nAdvance `i` by size + 2, or derive the bound from `data` rather than keeping a second counter."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T17:46:23.228Z",
"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"shortName": "eclipse"
},
"references": [
{
"url": "https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-8hj5-p46x-5h28"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"assignerShortName": "eclipse",
"cveId": "CVE-2026-102720",
"datePublished": "2026-09-29T17:46:23.228Z",
"dateReserved": "2026-09-29T16:15:16.300Z",
"dateUpdated": "2026-09-29T18:37:07.341Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102716 (GCVE-0-2026-102716)
Vulnerability from nvd – Published: 2026-09-29 17:43 – Updated: 2026-09-29 18:41
VLAI
EPSS
VEX
Summary
An unauthenticated client can drain the RTSP server's packet pool with a couple of dozen requests
that carry a Session header the parser cannot convert.
The Session branch returns the raw NetX error code instead of an RTSP status code:
```c
/* addons/rtsp/nx_rtsp_server.c:2754 */
status = _nx_utility_string_to_uint(field_value_ptr, field_value_length, &session_id);
if (status)
{
return(status); /* NX_INVALID_PARAMETERS / NX_SIZE_ERROR / NX_OVERFLOW */
}
```
Every other branch of the same function maps its failure to an RTSP status first. The CSeq branch
eighteen lines earlier does exactly that (line 2736 returns NX_RTSP_STATUS_CODE_BAD_REQUEST). The
raw code then reaches `_nx_rtsp_server_error_response_send` (nx_rtsp_server.c:1234), which does not
recognise it, takes a path that returns without releasing the response packet it already allocated,
and the block never goes back to the pool.
Six requests with an empty Session header against a 22 packet pool:
```
valid requests: after request 6: pool available = 21, AFTER = 22 / 22
malformed requests: after request 6: pool available = 16, AFTER = 17 / 22
```
One block per request, not returned when the client disconnects. Twenty six requests take the pool
to zero and the server starts failing allocations, after which it serves nobody. If the pool is
shared with the rest of the application, as it is in the shipped sample, the rest of the stack
stops with it.
Convert the `_nx_utility_string_to_uint` failure in the Session branch into
NX_RTSP_STATUS_CODE_BAD_REQUEST the way the CSeq branch does, and release the response packet on
every exit path of `_nx_rtsp_server_error_response_send`.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 18:40 UTC
CWE
- CWE-401 - Missing Release of Memory after Effective Lifetime
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Eclipse Foundation | eclipse-threadx/netxduo |
Affected:
0 , ≤ 6.5.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102716",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T18:40:53.878601Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T18:41:10.594Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "eclipse-threadx/netxduo",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "6.5.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "L0stHeart"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn unauthenticated client can drain the RTSP server\u0027s packet pool with a couple of dozen requests\u003c/p\u003e\u003cp\u003ethat carry a Session header the parser cannot convert.\u003c/p\u003e\u003cp\u003eThe Session branch returns the raw NetX error code instead of an RTSP status code:\u003c/p\u003e\u003cp\u003e```c\u003c/p\u003e\u003cp\u003e/* addons/rtsp/nx_rtsp_server.c:2754 */\u003c/p\u003e\u003cp\u003estatus = _nx_utility_string_to_uint(field_value_ptr, field_value_length, \u0026amp;session_id);\u003c/p\u003e\u003cp\u003eif (status)\u003c/p\u003e\u003cp\u003e{\u003c/p\u003e\u003ccode\u003e return(status); /* NX_INVALID_PARAMETERS / NX_SIZE_ERROR / NX_OVERFLOW */\u003c/code\u003e\u003cbr\u003e\u003cp\u003e}\u003c/p\u003e\u003cp\u003e```\u003c/p\u003e\u003cp\u003eEvery other branch of the same function maps its failure to an RTSP status first. The CSeq branch\u003c/p\u003e\u003cp\u003eeighteen lines earlier does exactly that (line 2736 returns NX_RTSP_STATUS_CODE_BAD_REQUEST). The\u003c/p\u003e\u003cp\u003eraw code then reaches `_nx_rtsp_server_error_response_send` (nx_rtsp_server.c:1234), which does not\u003c/p\u003e\u003cp\u003erecognise it, takes a path that returns without releasing the response packet it already allocated,\u003c/p\u003e\u003cp\u003eand the block never goes back to the pool.\u003c/p\u003e\u003cp\u003eSix requests with an empty Session header against a 22 packet pool:\u003c/p\u003e\u003cp\u003e```\u003c/p\u003e\u003cp\u003evalid requests: after request 6: pool available = 21, AFTER = 22 / 22\u003c/p\u003e\u003cp\u003emalformed requests: after request 6: pool available = 16, AFTER = 17 / 22\u003c/p\u003e\u003cp\u003e```\u003c/p\u003e\u003cp\u003eOne block per request, not returned when the client disconnects. Twenty six requests take the pool\u003c/p\u003e\u003cp\u003eto zero and the server starts failing allocations, after which it serves nobody. If the pool is\u003c/p\u003e\u003cp\u003eshared with the rest of the application, as it is in the shipped sample, the rest of the stack\u003c/p\u003e\u003cp\u003estops with it.\u003c/p\u003e\u003cp\u003eConvert the `_nx_utility_string_to_uint` failure in the Session branch into\u003c/p\u003e\u003cp\u003eNX_RTSP_STATUS_CODE_BAD_REQUEST the way the CSeq branch does, and release the response packet on\u003c/p\u003e\u003cp\u003eevery exit path of `_nx_rtsp_server_error_response_send`.\u003c/p\u003e"
}
],
"value": "An unauthenticated client can drain the RTSP server\u0027s packet pool with a couple of dozen requests\n\n\n\nthat carry a Session header the parser cannot convert.\n\n\n\nThe Session branch returns the raw NetX error code instead of an RTSP status code:\n\n\n\n```c\n\n\n\n/* addons/rtsp/nx_rtsp_server.c:2754 */\n\n\n\nstatus = _nx_utility_string_to_uint(field_value_ptr, field_value_length, \u0026session_id);\n\n\n\nif (status)\n\n\n\n{\n\n return(status); /* NX_INVALID_PARAMETERS / NX_SIZE_ERROR / NX_OVERFLOW */\n\n\n}\n\n\n\n```\n\n\n\nEvery other branch of the same function maps its failure to an RTSP status first. The CSeq branch\n\n\n\neighteen lines earlier does exactly that (line 2736 returns NX_RTSP_STATUS_CODE_BAD_REQUEST). The\n\n\n\nraw code then reaches `_nx_rtsp_server_error_response_send` (nx_rtsp_server.c:1234), which does not\n\n\n\nrecognise it, takes a path that returns without releasing the response packet it already allocated,\n\n\n\nand the block never goes back to the pool.\n\n\n\nSix requests with an empty Session header against a 22 packet pool:\n\n\n\n```\n\n\n\nvalid requests: after request 6: pool available = 21, AFTER = 22 / 22\n\n\n\nmalformed requests: after request 6: pool available = 16, AFTER = 17 / 22\n\n\n\n```\n\n\n\nOne block per request, not returned when the client disconnects. Twenty six requests take the pool\n\n\n\nto zero and the server starts failing allocations, after which it serves nobody. If the pool is\n\n\n\nshared with the rest of the application, as it is in the shipped sample, the rest of the stack\n\n\n\nstops with it.\n\n\n\nConvert the `_nx_utility_string_to_uint` failure in the Session branch into\n\n\n\nNX_RTSP_STATUS_CODE_BAD_REQUEST the way the CSeq branch does, and release the response packet on\n\n\n\nevery exit path of `_nx_rtsp_server_error_response_send`."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-401",
"description": "CWE-401 Missing Release of Memory after Effective Lifetime",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T17:43:55.870Z",
"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"shortName": "eclipse"
},
"references": [
{
"url": "https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-q462-246c-x3jc"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"assignerShortName": "eclipse",
"cveId": "CVE-2026-102716",
"datePublished": "2026-09-29T17:43:55.870Z",
"dateReserved": "2026-09-29T16:15:12.001Z",
"dateUpdated": "2026-09-29T18:41:10.594Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102715 (GCVE-0-2026-102715)
Vulnerability from nvd – Published: 2026-09-29 17:42 – Updated: 2026-09-29 18:42
VLAI
EPSS
VEX
Title
mDNS string-cache lookup matches on slot size, so a peer name aliases a shorter one and the response encoder writes past the packet
Summary
Any host on the LAN can send two mDNS records and make the responder write past the end of its
transmit packet.
The string table stores each name in a slot rounded up to a multiple of four:
```c
/* addons/mdns/nxd_mdns.c:11436, 11443, 11447 */
memory_len = ((memory_len & 0xFFFFFFFC) + 8) & 0xFFFFFFFF;
...
len = *((USHORT*)(p - 2)); /* slot size, not string length */
if ((len == memory_len) && ... _nx_mdns_name_match(start, memory_ptr, memory_size) ...)
```
The lookup that decides whether an incoming name is already stored compares the rounded slot size,
so names of 12, 13, 14 and 15 characters share one bucket. A second name in the bucket is answered
with the pointer to the first, and the record then carries a string up to three bytes longer than
the length the caller accounted for. `_nx_mdns_packet_rr_add` (nxd_mdns.c:8911) sizes its only
bound check from that stale length, and `_nx_mdns_name_string_encode` writes the real string.
Two PTR records are enough, both ordinary mDNS responses to a `_http._tcp` query, with owner names
whose lengths fall in the same bucket:
```
==87491==ERROR: AddressSanitizer: heap-buffer-overflow
WRITE of size 1 at 0x611000000124 thread T5
#0 _nx_mdns_name_string_encode addons/mdns/nxd_mdns.c:13096
#1 _nx_mdns_packet_rr_add addons/mdns/nxd_mdns.c:8911
0x611000000124 is 0 bytes to the right of 228-byte region
```
The overflow is one to three bytes of attacker-influenced name data past `nx_packet_data_end`. In a
normal pool that lands in the next packet in the same pool rather than in a redzone, so the visible
effect is a corrupted neighbouring packet or a corrupted pool free list rather than a clean crash.
Compare the slot size against the stored string length before declaring a match, or keep the
string length in the slot header and return it to the caller so the encoder and the bound check
agree.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 18:41 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Eclipse Foundation | eclipse-threadx/netxduo |
Affected:
0 , ≤ 6.5.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102715",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T18:41:47.412014Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T18:42:21.812Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "eclipse-threadx/netxduo",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "6.5.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "L0stHeart"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAny host on the LAN can send two mDNS records and make the responder write past the end of its\u003c/p\u003e\u003cp\u003etransmit packet.\u003c/p\u003e\u003cp\u003eThe string table stores each name in a slot rounded up to a multiple of four:\u003c/p\u003e\u003cp\u003e```c\u003c/p\u003e\u003cp\u003e/* addons/mdns/nxd_mdns.c:11436, 11443, 11447 */\u003c/p\u003e\u003cp\u003ememory_len = ((memory_len \u0026amp; 0xFFFFFFFC) + 8) \u0026amp; 0xFFFFFFFF;\u003c/p\u003e\u003cp\u003e...\u003c/p\u003e\u003cp\u003elen = *((USHORT*)(p - 2)); /* slot size, not string length */\u003c/p\u003e\u003cp\u003eif ((len == memory_len) \u0026amp;\u0026amp; ... _nx_mdns_name_match(start, memory_ptr, memory_size) ...)\u003c/p\u003e\u003cp\u003e```\u003c/p\u003e\u003cp\u003eThe lookup that decides whether an incoming name is already stored compares the rounded slot size,\u003c/p\u003e\u003cp\u003eso names of 12, 13, 14 and 15 characters share one bucket. A second name in the bucket is answered\u003c/p\u003e\u003cp\u003ewith the pointer to the first, and the record then carries a string up to three bytes longer than\u003c/p\u003e\u003cp\u003ethe length the caller accounted for. `_nx_mdns_packet_rr_add` (nxd_mdns.c:8911) sizes its only\u003c/p\u003e\u003cp\u003ebound check from that stale length, and `_nx_mdns_name_string_encode` writes the real string.\u003c/p\u003e\u003cp\u003eTwo PTR records are enough, both ordinary mDNS responses to a `_http._tcp` query, with owner names\u003c/p\u003e\u003cp\u003ewhose lengths fall in the same bucket:\u003c/p\u003e\u003cp\u003e```\u003c/p\u003e\u003cp\u003e==87491==ERROR: AddressSanitizer: heap-buffer-overflow\u003c/p\u003e\u003cp\u003eWRITE of size 1 at 0x611000000124 thread T5\u003c/p\u003e\u003ccode\u003e #0 _nx_mdns_name_string_encode addons/mdns/nxd_mdns.c:13096\u003c/code\u003e\u003cbr\u003e\u003ccode\u003e #1 _nx_mdns_packet_rr_add addons/mdns/nxd_mdns.c:8911\u003c/code\u003e\u003cbr\u003e\u003cp\u003e0x611000000124 is 0 bytes to the right of 228-byte region\u003c/p\u003e\u003cp\u003e```\u003c/p\u003e\u003cp\u003eThe overflow is one to three bytes of attacker-influenced name data past `nx_packet_data_end`. In a\u003c/p\u003e\u003cp\u003enormal pool that lands in the next packet in the same pool rather than in a redzone, so the visible\u003c/p\u003e\u003cp\u003eeffect is a corrupted neighbouring packet or a corrupted pool free list rather than a clean crash.\u003c/p\u003e\u003cp\u003eCompare the slot size against the stored string length before declaring a match, or keep the\u003c/p\u003e\u003cp\u003estring length in the slot header and return it to the caller so the encoder and the bound check\u003c/p\u003e\u003cp\u003eagree.\u003c/p\u003e"
}
],
"value": "Any host on the LAN can send two mDNS records and make the responder write past the end of its\n\n\n\ntransmit packet.\n\n\n\nThe string table stores each name in a slot rounded up to a multiple of four:\n\n\n\n```c\n\n\n\n/* addons/mdns/nxd_mdns.c:11436, 11443, 11447 */\n\n\n\nmemory_len = ((memory_len \u0026 0xFFFFFFFC) + 8) \u0026 0xFFFFFFFF;\n\n\n\n...\n\n\n\nlen = *((USHORT*)(p - 2)); /* slot size, not string length */\n\n\n\nif ((len == memory_len) \u0026\u0026 ... _nx_mdns_name_match(start, memory_ptr, memory_size) ...)\n\n\n\n```\n\n\n\nThe lookup that decides whether an incoming name is already stored compares the rounded slot size,\n\n\n\nso names of 12, 13, 14 and 15 characters share one bucket. A second name in the bucket is answered\n\n\n\nwith the pointer to the first, and the record then carries a string up to three bytes longer than\n\n\n\nthe length the caller accounted for. `_nx_mdns_packet_rr_add` (nxd_mdns.c:8911) sizes its only\n\n\n\nbound check from that stale length, and `_nx_mdns_name_string_encode` writes the real string.\n\n\n\nTwo PTR records are enough, both ordinary mDNS responses to a `_http._tcp` query, with owner names\n\n\n\nwhose lengths fall in the same bucket:\n\n\n\n```\n\n\n\n==87491==ERROR: AddressSanitizer: heap-buffer-overflow\n\n\n\nWRITE of size 1 at 0x611000000124 thread T5\n\n #0 _nx_mdns_name_string_encode addons/mdns/nxd_mdns.c:13096\n #1 _nx_mdns_packet_rr_add addons/mdns/nxd_mdns.c:8911\n\n\n0x611000000124 is 0 bytes to the right of 228-byte region\n\n\n\n```\n\n\n\nThe overflow is one to three bytes of attacker-influenced name data past `nx_packet_data_end`. In a\n\n\n\nnormal pool that lands in the next packet in the same pool rather than in a redzone, so the visible\n\n\n\neffect is a corrupted neighbouring packet or a corrupted pool free list rather than a clean crash.\n\n\n\nCompare the slot size against the stored string length before declaring a match, or keep the\n\n\n\nstring length in the slot header and return it to the caller so the encoder and the bound check\n\n\n\nagree."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T17:42:35.719Z",
"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"shortName": "eclipse"
},
"references": [
{
"url": "https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-2gf7-5224-5vrj"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "mDNS string-cache lookup matches on slot size, so a peer name aliases a shorter one and the response encoder writes past the packet",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"assignerShortName": "eclipse",
"cveId": "CVE-2026-102715",
"datePublished": "2026-09-29T17:42:35.719Z",
"dateReserved": "2026-09-29T16:15:11.235Z",
"dateUpdated": "2026-09-29T18:42:21.812Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102720 (GCVE-0-2026-102720)
Vulnerability from cvelistv5 – Published: 2026-09-29 17:46 – Updated: 2026-09-29 18:37
VLAI
EPSS
VEX
Summary
A DHCP server, or anyone on the LAN who answers a DISCOVER first, can make the client read about a
kilobyte past the end of the received message.
The option walk keeps a pointer and an offset in step, and the only bound check uses the offset:
```c
/* addons/dhcp/nxd_dhcp_client.c:7538, 7572 */
while (i < length - 1)
{
...
size = *(++data); /* data moves 1: type -> length byte */
data += size + 1; /* data moves size + 1 more */
i += size + 1; /* i moves only size + 1 */
}
```
A TLV option occupies size + 2 bytes. `data` is advanced by size + 2 in total, `i` by size + 1, so
the offset falls one byte behind the real read position for every option the walk skips. After
enough skipped options the check `i < length - 1` still holds while `data` is already past the end
of the message, and the subsequent read of the type and length bytes comes from whatever follows.
A single OFFER carrying a long run of skippable options is enough:
```
ERROR: AddressSanitizer: heap-buffer-overflow
READ of size 1 at 0x61b000000794 thread T5
#0 _nx_dhcp_search_buffer addons/dhcp/nxd_dhcp_client.c:7541
#1 _nx_dhcp_get_option_value addons/dhcp/nxd_dhcp_client.c:7082
0x61b000000794 is located 164 bytes to the right of 1648-byte region
```
A well formed OFFER through the same path is handled normally, the client records the offer and
moves to REQUESTING, so the difference is the option layout rather than the harness.
The read runs in the DHCP client thread while the client is still unconfigured, so it happens on
every boot in reach of a hostile DHCP responder. The values read are used to configure the
interface, which is how the disclosed bytes become observable.
Advance `i` by size + 2, or derive the bound from `data` rather than keeping a second counter.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 18:36 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Eclipse Foundation | eclipse-threadx/netxduo |
Affected:
0 , ≤ 6.5.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102720",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T18:36:33.534376Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T18:37:07.341Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "eclipse-threadx/netxduo",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "6.5.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "L0stHeart"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA DHCP server, or anyone on the LAN who answers a DISCOVER first, can make the client read about a\u003c/p\u003e\u003cp\u003ekilobyte past the end of the received message.\u003c/p\u003e\u003cp\u003eThe option walk keeps a pointer and an offset in step, and the only bound check uses the offset:\u003c/p\u003e\u003cp\u003e```c\u003c/p\u003e\u003cp\u003e/* addons/dhcp/nxd_dhcp_client.c:7538, 7572 */\u003c/p\u003e\u003cp\u003ewhile (i \u0026lt; length - 1)\u003c/p\u003e\u003cp\u003e{\u003c/p\u003e\u003ccode\u003e ...\u003c/code\u003e\u003cbr\u003e\u003ccode\u003e size = *(++data); /* data moves 1: type -\u0026gt; length byte */\u003c/code\u003e\u003cbr\u003e\u003ccode\u003e data += size + 1; /* data moves size + 1 more */\u003c/code\u003e\u003cbr\u003e\u003ccode\u003e i += size + 1; /* i moves only size + 1 */\u003c/code\u003e\u003cbr\u003e\u003cp\u003e}\u003c/p\u003e\u003cp\u003e```\u003c/p\u003e\u003cp\u003eA TLV option occupies size + 2 bytes. `data` is advanced by size + 2 in total, `i` by size + 1, so\u003c/p\u003e\u003cp\u003ethe offset falls one byte behind the real read position for every option the walk skips. After\u003c/p\u003e\u003cp\u003eenough skipped options the check `i \u0026lt; length - 1` still holds while `data` is already past the end\u003c/p\u003e\u003cp\u003eof the message, and the subsequent read of the type and length bytes comes from whatever follows.\u003c/p\u003e\u003cp\u003eA single OFFER carrying a long run of skippable options is enough:\u003c/p\u003e\u003cp\u003e```\u003c/p\u003e\u003cp\u003eERROR: AddressSanitizer: heap-buffer-overflow\u003c/p\u003e\u003cp\u003eREAD of size 1 at 0x61b000000794 thread T5\u003c/p\u003e\u003ccode\u003e #0 _nx_dhcp_search_buffer addons/dhcp/nxd_dhcp_client.c:7541\u003c/code\u003e\u003cbr\u003e\u003ccode\u003e #1 _nx_dhcp_get_option_value addons/dhcp/nxd_dhcp_client.c:7082\u003c/code\u003e\u003cbr\u003e\u003cp\u003e0x61b000000794 is located 164 bytes to the right of 1648-byte region\u003c/p\u003e\u003cp\u003e```\u003c/p\u003e\u003cp\u003eA well formed OFFER through the same path is handled normally, the client records the offer and\u003c/p\u003e\u003cp\u003emoves to REQUESTING, so the difference is the option layout rather than the harness.\u003c/p\u003e\u003cp\u003eThe read runs in the DHCP client thread while the client is still unconfigured, so it happens on\u003c/p\u003e\u003cp\u003eevery boot in reach of a hostile DHCP responder. The values read are used to configure the\u003c/p\u003e\u003cp\u003einterface, which is how the disclosed bytes become observable.\u003c/p\u003e\u003cp\u003eAdvance `i` by size + 2, or derive the bound from `data` rather than keeping a second counter.\u003c/p\u003e"
}
],
"value": "A DHCP server, or anyone on the LAN who answers a DISCOVER first, can make the client read about a\n\n\n\nkilobyte past the end of the received message.\n\n\n\nThe option walk keeps a pointer and an offset in step, and the only bound check uses the offset:\n\n\n\n```c\n\n\n\n/* addons/dhcp/nxd_dhcp_client.c:7538, 7572 */\n\n\n\nwhile (i \u003c length - 1)\n\n\n\n{\n\n ...\n size = *(++data); /* data moves 1: type -\u003e length byte */\n data += size + 1; /* data moves size + 1 more */\n i += size + 1; /* i moves only size + 1 */\n\n\n}\n\n\n\n```\n\n\n\nA TLV option occupies size + 2 bytes. `data` is advanced by size + 2 in total, `i` by size + 1, so\n\n\n\nthe offset falls one byte behind the real read position for every option the walk skips. After\n\n\n\nenough skipped options the check `i \u003c length - 1` still holds while `data` is already past the end\n\n\n\nof the message, and the subsequent read of the type and length bytes comes from whatever follows.\n\n\n\nA single OFFER carrying a long run of skippable options is enough:\n\n\n\n```\n\n\n\nERROR: AddressSanitizer: heap-buffer-overflow\n\n\n\nREAD of size 1 at 0x61b000000794 thread T5\n\n #0 _nx_dhcp_search_buffer addons/dhcp/nxd_dhcp_client.c:7541\n #1 _nx_dhcp_get_option_value addons/dhcp/nxd_dhcp_client.c:7082\n\n\n0x61b000000794 is located 164 bytes to the right of 1648-byte region\n\n\n\n```\n\n\n\nA well formed OFFER through the same path is handled normally, the client records the offer and\n\n\n\nmoves to REQUESTING, so the difference is the option layout rather than the harness.\n\n\n\nThe read runs in the DHCP client thread while the client is still unconfigured, so it happens on\n\n\n\nevery boot in reach of a hostile DHCP responder. The values read are used to configure the\n\n\n\ninterface, which is how the disclosed bytes become observable.\n\n\n\nAdvance `i` by size + 2, or derive the bound from `data` rather than keeping a second counter."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T17:46:23.228Z",
"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"shortName": "eclipse"
},
"references": [
{
"url": "https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-8hj5-p46x-5h28"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"assignerShortName": "eclipse",
"cveId": "CVE-2026-102720",
"datePublished": "2026-09-29T17:46:23.228Z",
"dateReserved": "2026-09-29T16:15:16.300Z",
"dateUpdated": "2026-09-29T18:37:07.341Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102716 (GCVE-0-2026-102716)
Vulnerability from cvelistv5 – Published: 2026-09-29 17:43 – Updated: 2026-09-29 18:41
VLAI
EPSS
VEX
Summary
An unauthenticated client can drain the RTSP server's packet pool with a couple of dozen requests
that carry a Session header the parser cannot convert.
The Session branch returns the raw NetX error code instead of an RTSP status code:
```c
/* addons/rtsp/nx_rtsp_server.c:2754 */
status = _nx_utility_string_to_uint(field_value_ptr, field_value_length, &session_id);
if (status)
{
return(status); /* NX_INVALID_PARAMETERS / NX_SIZE_ERROR / NX_OVERFLOW */
}
```
Every other branch of the same function maps its failure to an RTSP status first. The CSeq branch
eighteen lines earlier does exactly that (line 2736 returns NX_RTSP_STATUS_CODE_BAD_REQUEST). The
raw code then reaches `_nx_rtsp_server_error_response_send` (nx_rtsp_server.c:1234), which does not
recognise it, takes a path that returns without releasing the response packet it already allocated,
and the block never goes back to the pool.
Six requests with an empty Session header against a 22 packet pool:
```
valid requests: after request 6: pool available = 21, AFTER = 22 / 22
malformed requests: after request 6: pool available = 16, AFTER = 17 / 22
```
One block per request, not returned when the client disconnects. Twenty six requests take the pool
to zero and the server starts failing allocations, after which it serves nobody. If the pool is
shared with the rest of the application, as it is in the shipped sample, the rest of the stack
stops with it.
Convert the `_nx_utility_string_to_uint` failure in the Session branch into
NX_RTSP_STATUS_CODE_BAD_REQUEST the way the CSeq branch does, and release the response packet on
every exit path of `_nx_rtsp_server_error_response_send`.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 18:40 UTC
CWE
- CWE-401 - Missing Release of Memory after Effective Lifetime
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Eclipse Foundation | eclipse-threadx/netxduo |
Affected:
0 , ≤ 6.5.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102716",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T18:40:53.878601Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T18:41:10.594Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "eclipse-threadx/netxduo",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "6.5.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "L0stHeart"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn unauthenticated client can drain the RTSP server\u0027s packet pool with a couple of dozen requests\u003c/p\u003e\u003cp\u003ethat carry a Session header the parser cannot convert.\u003c/p\u003e\u003cp\u003eThe Session branch returns the raw NetX error code instead of an RTSP status code:\u003c/p\u003e\u003cp\u003e```c\u003c/p\u003e\u003cp\u003e/* addons/rtsp/nx_rtsp_server.c:2754 */\u003c/p\u003e\u003cp\u003estatus = _nx_utility_string_to_uint(field_value_ptr, field_value_length, \u0026amp;session_id);\u003c/p\u003e\u003cp\u003eif (status)\u003c/p\u003e\u003cp\u003e{\u003c/p\u003e\u003ccode\u003e return(status); /* NX_INVALID_PARAMETERS / NX_SIZE_ERROR / NX_OVERFLOW */\u003c/code\u003e\u003cbr\u003e\u003cp\u003e}\u003c/p\u003e\u003cp\u003e```\u003c/p\u003e\u003cp\u003eEvery other branch of the same function maps its failure to an RTSP status first. The CSeq branch\u003c/p\u003e\u003cp\u003eeighteen lines earlier does exactly that (line 2736 returns NX_RTSP_STATUS_CODE_BAD_REQUEST). The\u003c/p\u003e\u003cp\u003eraw code then reaches `_nx_rtsp_server_error_response_send` (nx_rtsp_server.c:1234), which does not\u003c/p\u003e\u003cp\u003erecognise it, takes a path that returns without releasing the response packet it already allocated,\u003c/p\u003e\u003cp\u003eand the block never goes back to the pool.\u003c/p\u003e\u003cp\u003eSix requests with an empty Session header against a 22 packet pool:\u003c/p\u003e\u003cp\u003e```\u003c/p\u003e\u003cp\u003evalid requests: after request 6: pool available = 21, AFTER = 22 / 22\u003c/p\u003e\u003cp\u003emalformed requests: after request 6: pool available = 16, AFTER = 17 / 22\u003c/p\u003e\u003cp\u003e```\u003c/p\u003e\u003cp\u003eOne block per request, not returned when the client disconnects. Twenty six requests take the pool\u003c/p\u003e\u003cp\u003eto zero and the server starts failing allocations, after which it serves nobody. If the pool is\u003c/p\u003e\u003cp\u003eshared with the rest of the application, as it is in the shipped sample, the rest of the stack\u003c/p\u003e\u003cp\u003estops with it.\u003c/p\u003e\u003cp\u003eConvert the `_nx_utility_string_to_uint` failure in the Session branch into\u003c/p\u003e\u003cp\u003eNX_RTSP_STATUS_CODE_BAD_REQUEST the way the CSeq branch does, and release the response packet on\u003c/p\u003e\u003cp\u003eevery exit path of `_nx_rtsp_server_error_response_send`.\u003c/p\u003e"
}
],
"value": "An unauthenticated client can drain the RTSP server\u0027s packet pool with a couple of dozen requests\n\n\n\nthat carry a Session header the parser cannot convert.\n\n\n\nThe Session branch returns the raw NetX error code instead of an RTSP status code:\n\n\n\n```c\n\n\n\n/* addons/rtsp/nx_rtsp_server.c:2754 */\n\n\n\nstatus = _nx_utility_string_to_uint(field_value_ptr, field_value_length, \u0026session_id);\n\n\n\nif (status)\n\n\n\n{\n\n return(status); /* NX_INVALID_PARAMETERS / NX_SIZE_ERROR / NX_OVERFLOW */\n\n\n}\n\n\n\n```\n\n\n\nEvery other branch of the same function maps its failure to an RTSP status first. The CSeq branch\n\n\n\neighteen lines earlier does exactly that (line 2736 returns NX_RTSP_STATUS_CODE_BAD_REQUEST). The\n\n\n\nraw code then reaches `_nx_rtsp_server_error_response_send` (nx_rtsp_server.c:1234), which does not\n\n\n\nrecognise it, takes a path that returns without releasing the response packet it already allocated,\n\n\n\nand the block never goes back to the pool.\n\n\n\nSix requests with an empty Session header against a 22 packet pool:\n\n\n\n```\n\n\n\nvalid requests: after request 6: pool available = 21, AFTER = 22 / 22\n\n\n\nmalformed requests: after request 6: pool available = 16, AFTER = 17 / 22\n\n\n\n```\n\n\n\nOne block per request, not returned when the client disconnects. Twenty six requests take the pool\n\n\n\nto zero and the server starts failing allocations, after which it serves nobody. If the pool is\n\n\n\nshared with the rest of the application, as it is in the shipped sample, the rest of the stack\n\n\n\nstops with it.\n\n\n\nConvert the `_nx_utility_string_to_uint` failure in the Session branch into\n\n\n\nNX_RTSP_STATUS_CODE_BAD_REQUEST the way the CSeq branch does, and release the response packet on\n\n\n\nevery exit path of `_nx_rtsp_server_error_response_send`."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-401",
"description": "CWE-401 Missing Release of Memory after Effective Lifetime",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T17:43:55.870Z",
"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"shortName": "eclipse"
},
"references": [
{
"url": "https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-q462-246c-x3jc"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"assignerShortName": "eclipse",
"cveId": "CVE-2026-102716",
"datePublished": "2026-09-29T17:43:55.870Z",
"dateReserved": "2026-09-29T16:15:12.001Z",
"dateUpdated": "2026-09-29T18:41:10.594Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102715 (GCVE-0-2026-102715)
Vulnerability from cvelistv5 – Published: 2026-09-29 17:42 – Updated: 2026-09-29 18:42
VLAI
EPSS
VEX
Title
mDNS string-cache lookup matches on slot size, so a peer name aliases a shorter one and the response encoder writes past the packet
Summary
Any host on the LAN can send two mDNS records and make the responder write past the end of its
transmit packet.
The string table stores each name in a slot rounded up to a multiple of four:
```c
/* addons/mdns/nxd_mdns.c:11436, 11443, 11447 */
memory_len = ((memory_len & 0xFFFFFFFC) + 8) & 0xFFFFFFFF;
...
len = *((USHORT*)(p - 2)); /* slot size, not string length */
if ((len == memory_len) && ... _nx_mdns_name_match(start, memory_ptr, memory_size) ...)
```
The lookup that decides whether an incoming name is already stored compares the rounded slot size,
so names of 12, 13, 14 and 15 characters share one bucket. A second name in the bucket is answered
with the pointer to the first, and the record then carries a string up to three bytes longer than
the length the caller accounted for. `_nx_mdns_packet_rr_add` (nxd_mdns.c:8911) sizes its only
bound check from that stale length, and `_nx_mdns_name_string_encode` writes the real string.
Two PTR records are enough, both ordinary mDNS responses to a `_http._tcp` query, with owner names
whose lengths fall in the same bucket:
```
==87491==ERROR: AddressSanitizer: heap-buffer-overflow
WRITE of size 1 at 0x611000000124 thread T5
#0 _nx_mdns_name_string_encode addons/mdns/nxd_mdns.c:13096
#1 _nx_mdns_packet_rr_add addons/mdns/nxd_mdns.c:8911
0x611000000124 is 0 bytes to the right of 228-byte region
```
The overflow is one to three bytes of attacker-influenced name data past `nx_packet_data_end`. In a
normal pool that lands in the next packet in the same pool rather than in a redzone, so the visible
effect is a corrupted neighbouring packet or a corrupted pool free list rather than a clean crash.
Compare the slot size against the stored string length before declaring a match, or keep the
string length in the slot header and return it to the caller so the encoder and the bound check
agree.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 18:41 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Eclipse Foundation | eclipse-threadx/netxduo |
Affected:
0 , ≤ 6.5.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102715",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T18:41:47.412014Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T18:42:21.812Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "eclipse-threadx/netxduo",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "6.5.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "L0stHeart"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAny host on the LAN can send two mDNS records and make the responder write past the end of its\u003c/p\u003e\u003cp\u003etransmit packet.\u003c/p\u003e\u003cp\u003eThe string table stores each name in a slot rounded up to a multiple of four:\u003c/p\u003e\u003cp\u003e```c\u003c/p\u003e\u003cp\u003e/* addons/mdns/nxd_mdns.c:11436, 11443, 11447 */\u003c/p\u003e\u003cp\u003ememory_len = ((memory_len \u0026amp; 0xFFFFFFFC) + 8) \u0026amp; 0xFFFFFFFF;\u003c/p\u003e\u003cp\u003e...\u003c/p\u003e\u003cp\u003elen = *((USHORT*)(p - 2)); /* slot size, not string length */\u003c/p\u003e\u003cp\u003eif ((len == memory_len) \u0026amp;\u0026amp; ... _nx_mdns_name_match(start, memory_ptr, memory_size) ...)\u003c/p\u003e\u003cp\u003e```\u003c/p\u003e\u003cp\u003eThe lookup that decides whether an incoming name is already stored compares the rounded slot size,\u003c/p\u003e\u003cp\u003eso names of 12, 13, 14 and 15 characters share one bucket. A second name in the bucket is answered\u003c/p\u003e\u003cp\u003ewith the pointer to the first, and the record then carries a string up to three bytes longer than\u003c/p\u003e\u003cp\u003ethe length the caller accounted for. `_nx_mdns_packet_rr_add` (nxd_mdns.c:8911) sizes its only\u003c/p\u003e\u003cp\u003ebound check from that stale length, and `_nx_mdns_name_string_encode` writes the real string.\u003c/p\u003e\u003cp\u003eTwo PTR records are enough, both ordinary mDNS responses to a `_http._tcp` query, with owner names\u003c/p\u003e\u003cp\u003ewhose lengths fall in the same bucket:\u003c/p\u003e\u003cp\u003e```\u003c/p\u003e\u003cp\u003e==87491==ERROR: AddressSanitizer: heap-buffer-overflow\u003c/p\u003e\u003cp\u003eWRITE of size 1 at 0x611000000124 thread T5\u003c/p\u003e\u003ccode\u003e #0 _nx_mdns_name_string_encode addons/mdns/nxd_mdns.c:13096\u003c/code\u003e\u003cbr\u003e\u003ccode\u003e #1 _nx_mdns_packet_rr_add addons/mdns/nxd_mdns.c:8911\u003c/code\u003e\u003cbr\u003e\u003cp\u003e0x611000000124 is 0 bytes to the right of 228-byte region\u003c/p\u003e\u003cp\u003e```\u003c/p\u003e\u003cp\u003eThe overflow is one to three bytes of attacker-influenced name data past `nx_packet_data_end`. In a\u003c/p\u003e\u003cp\u003enormal pool that lands in the next packet in the same pool rather than in a redzone, so the visible\u003c/p\u003e\u003cp\u003eeffect is a corrupted neighbouring packet or a corrupted pool free list rather than a clean crash.\u003c/p\u003e\u003cp\u003eCompare the slot size against the stored string length before declaring a match, or keep the\u003c/p\u003e\u003cp\u003estring length in the slot header and return it to the caller so the encoder and the bound check\u003c/p\u003e\u003cp\u003eagree.\u003c/p\u003e"
}
],
"value": "Any host on the LAN can send two mDNS records and make the responder write past the end of its\n\n\n\ntransmit packet.\n\n\n\nThe string table stores each name in a slot rounded up to a multiple of four:\n\n\n\n```c\n\n\n\n/* addons/mdns/nxd_mdns.c:11436, 11443, 11447 */\n\n\n\nmemory_len = ((memory_len \u0026 0xFFFFFFFC) + 8) \u0026 0xFFFFFFFF;\n\n\n\n...\n\n\n\nlen = *((USHORT*)(p - 2)); /* slot size, not string length */\n\n\n\nif ((len == memory_len) \u0026\u0026 ... _nx_mdns_name_match(start, memory_ptr, memory_size) ...)\n\n\n\n```\n\n\n\nThe lookup that decides whether an incoming name is already stored compares the rounded slot size,\n\n\n\nso names of 12, 13, 14 and 15 characters share one bucket. A second name in the bucket is answered\n\n\n\nwith the pointer to the first, and the record then carries a string up to three bytes longer than\n\n\n\nthe length the caller accounted for. `_nx_mdns_packet_rr_add` (nxd_mdns.c:8911) sizes its only\n\n\n\nbound check from that stale length, and `_nx_mdns_name_string_encode` writes the real string.\n\n\n\nTwo PTR records are enough, both ordinary mDNS responses to a `_http._tcp` query, with owner names\n\n\n\nwhose lengths fall in the same bucket:\n\n\n\n```\n\n\n\n==87491==ERROR: AddressSanitizer: heap-buffer-overflow\n\n\n\nWRITE of size 1 at 0x611000000124 thread T5\n\n #0 _nx_mdns_name_string_encode addons/mdns/nxd_mdns.c:13096\n #1 _nx_mdns_packet_rr_add addons/mdns/nxd_mdns.c:8911\n\n\n0x611000000124 is 0 bytes to the right of 228-byte region\n\n\n\n```\n\n\n\nThe overflow is one to three bytes of attacker-influenced name data past `nx_packet_data_end`. In a\n\n\n\nnormal pool that lands in the next packet in the same pool rather than in a redzone, so the visible\n\n\n\neffect is a corrupted neighbouring packet or a corrupted pool free list rather than a clean crash.\n\n\n\nCompare the slot size against the stored string length before declaring a match, or keep the\n\n\n\nstring length in the slot header and return it to the caller so the encoder and the bound check\n\n\n\nagree."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T17:42:35.719Z",
"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"shortName": "eclipse"
},
"references": [
{
"url": "https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-2gf7-5224-5vrj"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "mDNS string-cache lookup matches on slot size, so a peer name aliases a shorter one and the response encoder writes past the packet",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"assignerShortName": "eclipse",
"cveId": "CVE-2026-102715",
"datePublished": "2026-09-29T17:42:35.719Z",
"dateReserved": "2026-09-29T16:15:11.235Z",
"dateUpdated": "2026-09-29T18:42:21.812Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}