Use after free in Eclipse Foundation NetX Duo
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
When NetX Secure is built with `NX_SECURE_KEY_CLEAR`, every TLS record sent on an active session is wiped after it has been handed to TCP. By then the TCP layer owns the packet chain and may already have released it to the packet pool. The wipe therefore writes zeros into packets that are free or in use by another thread, and when a reused packet's pointers no longer describe the old data, the length of the wipe underflows and it runs past the end of the packet pool.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Eclipse Foundation | NetX Duo | 6.0 – 6.5.1.202602 | 6.5.2.202603 | Patch available | CNA |
- NetX Duo VendorEclipse Foundation Affected 6.0 – 6.5.1.202602 Fixed in 6.5.2.202603 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eclipse:threadx_netx_duo:*:*:*:*:*:*:*:* | — | — | Eclipse Foundation |
- cpe:2.3:a:eclipse:threadx_netx_duo:*:*:*:*:*:*:*:* Versions — — ·Eclipse Foundation
Remediation
- Fix · CNA NetX Duo (Eclipse Foundation) Fixed in 6.5.2.202603
Timeline
- 2026-10-02 Threatist record created from CVE-2026-102760
- 2026-10-03 Alias added: GHSA-mmmp-6qxx-j473
More Eclipse Foundation vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2026-81947 Unauthenticated command injection in Eclipse Che che-machine-exec CVSS 3.1CRITICAL 9.8
- TI-2026-13216 CWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSyx Go Components CVSS 3.1CRITICAL 9.8
- TI-2026-06514 Path traversal in Eclipse BaSyx CVSS 3.1CRITICAL 10.0
- TI-2026-01382 In the Eclipse Theia Website repository, the GitHub Actions workflow… CVSS 3.1CRITICAL 10.0
- TI-2026-74697 Authentication bypass in Eclipse Jetty EthereumAuthenticator CVSS 4.0CRITICAL 9.3
Sources
- CVE-2026-102760 · CVE Program
- CVE-2026-102760 · NVD
- FIRST EPSS
- GHSA-mmmp-6qxx-j473 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences