CVE-2026-94018: NetX Duo Web HTTP server releases an uninitialized packet pointer on the PUT Content-Length underflow path

Published Oct 20, 2026

Updated

The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a Content-Length underflow while processing a PUT request. The condition is reachable by an unauthenticated remote client with a single malformed request.

Affected Software

1 affected component

Eclipse ThreadX NetX Duo Web HTTP Server

Event History

Oct 20, 2026

CVE Published

via MITRE·03:10 PM

Data Sourced

via MITRE·03:10 PM

DescriptionWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments running the Eclipse ThreadX NetX Duo Web HTTP Server's Web add-on are exposed if the HTTP server is reachable by a remote client. No authentication or user interaction is required.

What must an attacker send to trigger the vulnerable path?

An attacker needs to send a single malformed HTTP PUT request that causes a Content-Length underflow. The attack is network-reachable and has low complexity.

What is the likely impact of successful exploitation?

The server can dereference and release an uninitialized packet pointer. The provided CVSS assessment indicates high availability impact and low integrity impact, with no confidentiality impact.

CVE-2026-94018: NetX Duo Web HTTP server releases an uninitialized packet pointer on the PUT Content-Length underflow path

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker send to trigger the vulnerable path?

What is the likely impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker send to trigger the vulnerable path?

What is the likely impact of successful exploitation?