CVE-2026-115215High· 8.7▾ TwilightIn Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server allocates a session from its fixed session pool for the first datagram from any unrecognised address and port, before the cookie exchange, and ne…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.4%
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server allocates a session from its fixed session pool for the first datagram from any unrecognised address and port, before the cookie exchange, and never releases a session whose handshake stalls. A remote, unauthenticated attacker can exhaust the pool with one spoofed datagram per source and deny DTLS service to legitimate clients until the application resets the sessions.
eclipse_threadx >= 6.0 <= 6.5.2.202603aRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-113421High· 7.3ThreadX Modules invokes trace-full callbacks after module unload
CVE-2026-115231High· 8.5User-mode module can post forged callback requests to another module's callback queue, running its code with that module's privilege
CVE-2026-118487High· 7.5Heap exhaustion via unbounded line accumulation in Vert.x STOMP FrameParser
CVE-2026-89295NoneUnauthenticated memory-exhaustion denial of service in Eclipse Mnestix AAS Generator unbounded count parameter
CVE-2026-115403High· 8.2NULL pointer dereference in the BSD raw IPv6 send path when the destination table is full
CVE-2026-118052Medium· 6.8Module Manager loaders leave the manager mutex held when a module preamble's sizes overflow, blocking every later module operation