Eclipse ThreadX NetX Duo 6.5.2.202603a is now available (security hotfix)

[fdesbiens]

Hi everyone.

NetX Duo 6.5.2.202603a is now available. It is a security hotfix: it fixes eight vulnerabilities and contains no other changes.

Update if you are running 6.5.2.202603 or earlier and use the NetX Secure DTLS server, X.509 certificate parsing, IPv6 and ICMPv6, or the mDNS, RTSP, SNMP or TFTP add-ons. All eight are reachable without credentials and without user interaction — six over the network, two from the local link.

The eight, with the highest severity first:

• CVE-2026-106465 (8.7 High) — the DTLS server accepted any non-empty cookie as proof of return routability, so one spoofed ClientHello skipped the HelloVerifyRequest exchange.
• CVE-2026-106464 (8.7 High) — an out-of-bounds read parsing an X.509 certificate whose signature BIT STRING is empty.
• CVE-2026-102718 (8.7 High) — an out-of-bounds read in the SNMP OID parser via a multi-byte BER length.
• CVE-2026-102716 (8.7 High) — a malformed RTSP Session header permanently orphans one packet-pool block per request.
• CVE-2026-102713 (8.3 High) — an unbounded TFTP DATA datagram causes an out-of-bounds read and a permanent stall of the server thread.
• CVE-2026-102714 (7.1 High) — ICMPv6 option validation accepts a trailing byte residue, sending four option walkers past the packet or into a loop.
• CVE-2026-102715 (7.1 High) — the mDNS string cache accepts a shorter name as a match for a longer stored one, so the encoder writes past the packet.
• CVE-2026-102712 (6.3 Medium) — an out-of-bounds read in the DTLS ClientHello parser.

All eight affect every release up to and including 6.5.2.202603 and are fixed in 6.5.2.202603a. There are no API changes, so applications need no source change.

Each advisory carries the full analysis, the affected configurations and any workaround: https://github.com/eclipse-threadx/netxduo/security/advisories

The release and its notes: https://github.com/eclipse-threadx/netxduo/releases/tag/v6.5.2.202603a_rel

Our thanks to @L0stHeart, Arash Ale Ebrahim from SYSPWN (@Microsvuln), Cipher of Causal Security (@cipher-creator), @afldl, @adawn0106 and @D7EAD, who reported these responsibly and waited while the fixes were prepared.

Frédéric Desbiens
Project Lead, Eclipse ThreadX