CVE-2026-93003: falha de média gravidade em Eclipse ThreadX - NetX Duo
NetX Duo Web HTTP server interprets request body content as HTTP header fields
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.9epss 0.3%
The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A header field name placed in the request body is therefore reported to the server as though it were a header, which lets a client control request framing decisions it should not be able to reach.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Produtos afetados
Eclipse Foundation · Eclipse ThreadX - NetX DuoCVEs relacionadas — Eclipse ThreadX - NetX Duo
No mesmo produto, das mais perigosas para as menos.
CVE-2026-11576HIGHCVE-2026-11576EPSS 0.5%CVE-2025-55102HIGHCVE-2025-55102EPSS 0.4%CVE-2026-94018HIGHNetX Duo Web HTTP server releases an uninitialized packet pointer on the PUT Content-Length underflow pathEPSS 0.4%CVE-2026-92843HIGHOut-of-bounds Read via the TLS 1.3 Certificate extensions_length in NetX SecureEPSS 0.3%CVE-2026-92853HIGHOut-of-bounds Read via a Zero-length TLS 1.3 Certificate Message in NetX SecureEPSS 0.3%CVE-2026-93475CRITICALOut-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509EPSS 0.2%