CVE-2025-0728: Eclipse ThreadX NetX Duo HTTP server single PUT request integer underflow
In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.2, an attacker can cause an integer underflow and a subsequent denial of service by writing a very large file, by specially crafted packets with Content-Length smaller than the data request size. A possible workaround is to disable HTTP PUT support.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.4.2Patch Eclipse ThreadX NetX Duo HTTP server single PUT request integer underflow - Configuration
Disable HTTP PUT support as a workaround for Eclipse ThreadX NetX Duo HTTP server functionality where crafted packets can have a Content-Length smaller than the data request size.
Eclipse ThreadX NetX Duo HTTP server HTTP PUT support = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2025-0728?
CVE-2025-0728 has a severity rating that suggests it can lead to a denial of service due to integer underflow vulnerabilities.
How do I fix CVE-2025-0728?
To mitigate CVE-2025-0728, upgrade Eclipse ThreadX NetX Duo to version 6.4.2 or later.
What systems are affected by CVE-2025-0728?
CVE-2025-0728 affects Eclipse ThreadX NetX Duo versions prior to 6.4.2.
What type of attack is associated with CVE-2025-0728?
CVE-2025-0728 is associated with a denial of service attack caused by specially crafted packets.
Can CVE-2025-0728 lead to data loss?
While CVE-2025-0728 primarily leads to denial of service, it may indirectly cause data loss if the service is disrupted during critical operations.