CVE-2025-2258: Eclipse ThreadX NetX Duo HTTP server single PUT request integer underflow
In NetX Duo component HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.3, an attacker can cause an integer underflow and a subsequent denial of service by writing a very large file, by specially crafted packets with Content-Length smaller than the data request size. A possible workaround is to disable HTTP PUT support.
This issue follows an uncomplete fix in CVE-2025-0728.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.4.3 - Configuration
Disable HTTP PUT support as a workaround for the single PUT request integer underflow issue in the NetX Duo HTTP server.
Eclipse ThreadX NetX Duo HTTP server HTTP PUT support = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2025-2258?
CVE-2025-2258 is classified as a denial-of-service vulnerability, which can significantly affect the availability of the affected system.
How do I fix CVE-2025-2258?
To mitigate CVE-2025-2258, update Eclipse ThreadX NetX Duo to version 6.4.3 or later.
What causes the CVE-2025-2258 vulnerability?
CVE-2025-2258 is caused by an integer underflow issue in the HTTP server functionality when processing packets with a Content-Length smaller than the actual data.
Which versions of Eclipse ThreadX NetX Duo are affected by CVE-2025-2258?
Versions of Eclipse ThreadX NetX Duo prior to 6.4.3 are affected by CVE-2025-2258.
What can an attacker achieve by exploiting CVE-2025-2258?
An attacker can exploit CVE-2025-2258 to induce a denial of service by writing a very large file through specially crafted HTTP packets.