CVE-2026-94018
NetX Duo Web HTTP server releases an uninitialized packet pointer on the PUT Content-Length underflow path
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a `Content-Length` underflow while processing a `PUT` request. The condition is reachable by an unauthenticated remote client with a single malformed request.
| CWE | CWE-457 CWE-824 |
| Vendor | eclipse foundation |
| Product | eclipse threadx - netx duo |
| Published | Oct 20, 2026 |
Stay Ahead of the Next One
Get instant alerts for eclipse foundation eclipse threadx - netx duo
Be the first to know when new unknown vulnerabilities affecting eclipse foundation eclipse threadx - netx duo are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Eclipse Foundation / Eclipse ThreadX - NetX Duo
6.4.2 ≤ 6.5.1.202602
References
Credits
🔍 Yves57