What is CVE-2026-115215 in Eclipse ThreadX NetX Duo?

CVE-2026-115215 is a high-severity security vulnerability identified in Eclipse ThreadX NetX Duo. Similar security flaws in software components are often analyzed alongside issues like vulnerabilidad critica de escalada, though this specific case focuses on network denial of service.

The flaw originates in the NetX Secure DTLS server component when processing incoming connections and managing its memory resources before performing proper client authentication or cookie exchanges.

Who is affected by this DTLS vulnerability?

The vulnerability affects Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a. Systems relying on these versions for secure network communications in embedded environments are exposed.

Evaluating risks in firmware requires keeping track of advisories and consulting sources such as informes de seguridad y permisos to ensure robust defenses across all application layers.

How does the denial of service attack work?

The NetX Secure DTLS server allocates a session from its fixed session pool for the first datagram from any unrecognized address and port before completing the cookie exchange. If a handshake stalls, the server never releases the session.

An unauthenticated remote attacker can exploit this behavior by sending a single spoofed datagram per source. This completely exhausts the session pool and denies DTLS service to legitimate clients until the application resets the sessions.

How can I protect my systems?

Mitigating this vulnerability requires careful monitoring and updates from the maintainers. Reviewing architectural choices helps prevent similar issues, much like handling fallos de use-after-free in system software.

Follow these steps to protect your embedded systems:

  1. Identify if your project uses Eclipse ThreadX NetX Duo versions between 6.0 and 6.5.2.202603a.
  2. Check the official GitHub advisory repository at https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-3p2g-x7hh-3w4c for official patches.
  3. Apply available updates or patches provided by the Eclipse Foundation.
  4. Implement network filtering or rate limiting on incoming DTLS datagrams to mitigate spoofed traffic exhaustion.