Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-103416 Details

UNDERGOING ENRICHMENT

The CVE is currently being enriched by the Volerion team. The enrichment process results in the association of reference link tags, CVSS, and CPE applicability statement data.

Description

Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cache writes past it and on into the rest of the session control block, which holds pointers. A malicious or compromised server can make a TLS 1.3 client produce such a message before certificate authentication completes, so no server certificate is needed to reach it.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:…Vector:This vulnerability is currently being analyzed.

No CVSS 3.x data is available for this CVE.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-4x76-j955-qhq2	[email protected]
https://gitlab.eclipse.org/security/cve-assignment/-/work_items/356	[email protected]

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-787	Out-of-bounds Write	[email protected]

Affected Products

This vulnerability is currently being analyzed

Change History

1 change record found show changes