CVE-2026-94018: falha de alta gravidade em Eclipse ThreadX - NetX Duo
NetX Duo Web HTTP server releases an uninitialized packet pointer on the PUT Content-Length underflow path
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.8epss 0.4%
The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a `Content-Length` underflow while processing a `PUT` request. The condition is reachable by an unauthenticated remote client with a single malformed request.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
Produtos afetados
Eclipse Foundation · Eclipse ThreadX - NetX DuoCVEs relacionadas — Eclipse ThreadX - NetX Duo
No mesmo produto, das mais perigosas para as menos.
CVE-2026-11576HIGHCVE-2026-11576EPSS 0.5%CVE-2025-55102HIGHCVE-2025-55102EPSS 0.4%CVE-2026-93003MEDIUMNetX Duo Web HTTP server interprets request body content as HTTP header fieldsEPSS 0.3%CVE-2026-92843HIGHOut-of-bounds Read via the TLS 1.3 Certificate extensions_length in NetX SecureEPSS 0.3%CVE-2026-92853HIGHOut-of-bounds Read via a Zero-length TLS 1.3 Certificate Message in NetX SecureEPSS 0.3%CVE-2026-93475CRITICALOut-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509EPSS 0.2%