CVE-2025-2259: Eclipse ThreadX NetX Duo component HTTP server single PUT request integer underflow
In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.3, an attacker can cause an integer underflow and a subsequent denial of service by writing a very large file, by specially crafted packets with Content-Length in one packet smaller than the data request size of the other packet. A possible workaround is to disable HTTP PUT support.
This issue follows an incomplete fix of CVE-2025-0727
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.4.3 - Configuration
Disable HTTP PUT support in the Eclipse ThreadX NetX Duo component HTTP server.
Eclipse ThreadX NetX Duo (HTTP server) HTTP PUT support = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2025-2259?
CVE-2025-2259 has a severity rating of medium due to its potential for denial of service attacks.
How do I fix CVE-2025-2259?
To mitigate CVE-2025-2259, upgrade Eclipse ThreadX NetX Duo to version 6.4.3 or later.
What type of attack does CVE-2025-2259 facilitate?
CVE-2025-2259 facilitates a denial of service attack by exploiting an integer underflow.
Which versions of Eclipse ThreadX NetX Duo are affected by CVE-2025-2259?
Versions of Eclipse ThreadX NetX Duo prior to 6.4.3 are affected by CVE-2025-2259.
What are the implications of CVE-2025-2259 for users of Eclipse ThreadX NetX Duo?
Users of Eclipse ThreadX NetX Duo may experience service disruption due to the denial of service vulnerabilities introduced by CVE-2025-2259.