CVE-2026-115215: NetX Secure DTLS server allocates a session for each new source before the cookie exchange and never reclaims it, so spoofed datagrams exhaust the session pool
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server allocates a session from its fixed session pool for the first datagram from any unrecognised address and port, before the cookie exchange, and never releases a session whose handshake stalls. A remote, unauthenticated attacker can exhaust the pool with one spoofed datagram per source and deny DTLS service to legitimate clients until the application resets the sessions.
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service condition?
NetX Secure DTLS server deployments using Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a are affected. The issue concerns servers that accept DTLS traffic and use the fixed session pool.
Does an attacker need credentials or a completed DTLS handshake?
No. A remote unauthenticated attacker can send a single spoofed datagram for each source address and port; session allocation occurs before the cookie exchange.
What happens when the session pool is exhausted?
Legitimate clients are denied DTLS service. Sessions associated with stalled handshakes are not released, so service remains unavailable until the application resets the sessions.
What can be done if patching is not immediately possible?
The provided information identifies resetting sessions through the application as the way to recover service after exhaustion. It does not provide a preventative workaround.