Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

NetX Duo client can be crashed by crafted TLS cookie

CVE-2026-103415 · published 1 day ago
Summary

The NetX Duo client may copy a server-provided cookie into a follow‑up TLS handshake message without checking its size. A malicious server can send an oversized cookie, causing the client to write beyond its buffer and potentially crash or be compromised. Update the client software or apply the vendor’s patch to add proper length checks.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
eclipse foundation netx duo <= 6.5.1.202602
Original advisory text
When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without checking that the cookie fits in the outgoing packet. Both the length and the ...
When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without checking that the cookie fits in the outgoing packet. Both the length and the contents of that cookie come from the peer, and the write happens before certificate authentication completes, so a malicious or compromised server can overwrite memory past the caller supplied TLS packet buffer without presenting a certificate.



Only the client path is affected.
References
Severity
9.3 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-787Out-of-bounds Write
Timeline
Published14 Oct 2026
Updated15 Oct 2026
First seen14 Oct 2026
Sources
CVE-2026-103415 · NVD
CVE-2026-103415 · MITRE
CVE-2026-103415 · OSV
GHSA-5pv3-rhf5-gwgq · GHSA
Track software like this
Free during beta