CVE-2026-115215

UNKNOWN 0.0

NetX Secure DTLS server allocates a session for each new source before the cookie exchange and never reclaims it, so spoofed datagrams exhaust the session pool

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server allocates a session from its fixed session pool for the first datagram from any unrecognised address and port, before the cookie exchange, and never releases a session whose handshake stalls. A remote, unauthenticated attacker can exhaust the pool with one spoofed datagram per source and deny DTLS service to legitimate clients until the application resets the sessions.

CWE	CWE-770 CWE-772
Vendor	eclipse foundation
Product	eclipse threadx
Published	Nov 2, 2026

Stay Ahead of the Next One

Get instant alerts for eclipse foundation eclipse threadx

Be the first to know when new unknown vulnerabilities affecting eclipse foundation eclipse threadx are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Eclipse Foundation / Eclipse ThreadX

6.0 ≤ 6.5.2.202603a

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-3p2g-x7hh-3w4c gitlab.eclipse.org: https://gitlab.eclipse.org/security/cve-assignment/-/work_items/487

Credits

Frédéric Desbiens