CVE-2025-0727: Eclipse ThreadX NetX Duo HTTP server single PUT request integer underflow
In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.2, an attacker can cause an integer underflow and a subsequent denial of service by writing a very large file, by specially crafted packets with Content-Length in one packet smaller than the data request size of the other packet. A possible workaround is to disable HTTP PUT support.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable HTTP PUT support to mitigate the integer underflow risk in the NetX Duo HTTP server.
Eclipse ThreadX NetX Duo HTTP server HTTP PUT support = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2025-0727?
CVE-2025-0727 has been classified as a high severity vulnerability due to its potential to cause a denial of service.
How do I fix CVE-2025-0727?
To fix CVE-2025-0727, update Eclipse ThreadX NetX Duo to version 6.4.2 or later.
What vulnerabilities does CVE-2025-0727 exploit?
CVE-2025-0727 exploits an integer underflow in the HTTP server functionality.
What are the potential impacts of CVE-2025-0727?
The potential impacts of CVE-2025-0727 include denial of service due to the ability to write excessively large files.
Who is affected by CVE-2025-0727?
CVE-2025-0727 affects users of Eclipse ThreadX NetX Duo versions prior to 6.4.2.