{"id":"CVE-2026-115215","kind":"vulnerability","aliases":["CVE-2026-115215"],"related":[],"title":"Eclipse ThreadX NetX Duo: DTLS server session pool exhaustion denies service","description":"In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server allocates a session from its fixed session pool for the first datagram from any unrecognised address and port, before the cookie exchange, and never releases a session whose handshake stalls. A remote, unauthenticated attacker can exhaust the pool with one spoofed datagram per source and deny DTLS service to legitimate clients until the application resets the sessions.","summary":"The NetX Secure DTLS server in Eclipse ThreadX NetX Duo reserves a session from a fixed pool for the first datagram from any unknown address before the cookie exchange, and never frees sessions whose handshake stalls. A remote unauthenticated attacker can send one spoofed datagram per source to fill the pool and block legitimate DTLS clients until the application resets the sessions.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"netxduo","fixed":["6.5.2.202603b"],"affected":">= 6.0, <= 6.5.2.202603a","ecosystem":"vendor"}],"ecosystems":[],"tags":["dtls","eclipse","embedded","infrastructure","iot","netx-duo","rtos","threadx"],"not_affected_if":["dtls-client-only","no-dtls-server","other-tls-stack"],"how_to_check":"- Check whether your firmware builds NetX Duo with the NetX Secure DTLS server (nx_secure_dtls_server_*); DTLS clients are unaffected and no build option disables the flaw.\n- Check the NetX Duo version in your source tree or SDK: 6.0 through 6.5.2.202603a are affected; 6.5.2.202603b is fixed.","fix":"Upgrade NetX Duo to 6.5.2.202603b. Optionally supply a cookie secret with nx_secure_dtls_server_cookie_secret_set (otherwise drawn from NX_RAND). Workaround if you cannot upgrade: reset sessions whose handshake has not completed within a timeout using nx_secure_dtls_session_reset() or nx_secure_dtls_session_end(); this frees slots but does not stop a burst filling the pool. Ingress filtering against source-address spoofing reduces exposure upstream.","status":"open","published_at":"2026-11-02T22:17:18+00:00","first_seen_at":"2026-11-02T22:35:42+00:00","triaged_at":"2026-11-02T22:37:48+00:00","updated_at":"2026-11-02T22:38:50+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-11-02T22:37:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Eclipse ThreadX NetX Duo: DTLS server session pool exhaustion denies service","impact":"medium","summary":"The NetX Secure DTLS server in Eclipse ThreadX NetX Duo reserves a session from a fixed pool for the first datagram from any unknown address before the cookie exchange, and never frees sessions whose handshake stalls. A remote unauthenticated attacker can send one spoofed datagram per source to fill the pool and block legitimate DTLS clients until the application resets the sessions.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["netx-duo","threadx","dtls","embedded","iot"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote attacker denies DTLS service to legitimate clients until reset","analyst_note":"Find the fixed version or vendor patch in the Eclipse advisory linked from the GitHub advisory; the sources give no fix.","how_to_check":"- Check whether the device or firmware uses NetX Duo with NetX Secure DTLS server enabled, and note the NetX Duo version.\n- Confirm the NetX Duo version is within 6.0 through 6.5.2.202603a.","plain_action":"","needs_analyst":true,"not_affected_if":["no-dtls-server","other-tls-stack"],"who_is_affected":"Embedded devices and IoT products built on Eclipse ThreadX NetX Duo that run a DTLS server with the NetX Secure stack. Systems that do not run a NetX Secure DTLS server, or that run other TLS stacks, are not affected. The sources do not say which device families are shipped with it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000738,"input_tokens":4216,"output_tokens":633,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed version or vendor patch in the Eclipse advisory linked from the GitHub advisory; the sources give no fix.","search":"'-115215':14A,17A '-2026':13A,16A '6.0':97C '6.5.2.202603':99C 'address':53B,121C 'alloc':106C 'applic':87B,159C 'attack':68B,139C 'block':81B 'client':84B,156C 'cooki':56B,126C 'cve':12A,15A 'datagram':49B,73B,117C,147C 'deni':10A,151C 'dtls':5A,19B,32B,83B,104C,152C 'duo':4A,26B,38B,95C 'eclips':1A,20B,35B,92C 'embed':21B 'exchang':57B,127C 'exhaust':9A,141C 'fill':77B 'first':48B,116C 'fix':44B,111C 'free':60B 'handshak':63B,134C 'infrastructur':22B 'iot':23B 'legitim':82B,155C 'netx':3A,25B,30B,37B,94C,102C 'netx-duo':24B 'netxduo':18A 'never':59B,129C 'one':71B,145C 'per':74B,148C 'pool':8A,45B,79B,113C,143C 'port':123C 'releas':130C 'remot':66B,137C 'reserv':39B 'reset':88B,160C 'rtos':27B 'secur':31B,103C 'send':70B 'server':6A,33B,105C 'servic':11A,153C 'session':7A,41B,61B,90B,108C,112C,132C,162C 'sourc':75B,149C 'spoof':72B,146C 'stall':64B,135C 'threadx':2A,28B,36B,93C 'unauthent':67B,138C 'unknown':52B 'unrecognis':120C 'version':96C 'whose':62B,133C","nicknames":[],"mitigations":[],"who_affected":"Embedded and IoT firmware that includes Eclipse ThreadX NetX Duo and runs a NetX Secure DTLS server on any version from 6.0 through 6.5.2.202603a. The flaw is in the common DTLS receive path, not behind a build option. Devices that only act as DTLS clients, or use another TLS/DTLS stack, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-02T22:38:50Z","by":"analyst","doc":"https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-3p2g-x7hh-3w4c","run_id":1438},"products":{"at":"2026-11-02T22:38:50Z","by":"analyst","doc":"https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-3p2g-x7hh-3w4c","run_id":1438},"how_to_check":{"at":"2026-11-02T22:38:50Z","by":"analyst","doc":"https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-3p2g-x7hh-3w4c","run_id":1438},"who_affected":{"at":"2026-11-02T22:38:50Z","by":"analyst","doc":"https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-3p2g-x7hh-3w4c","run_id":1438}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["netxduo"],"ptokens":["netxduo"],"labels":["dtls","eclipse","embedded","high","infrastructure","iot","netxduo","rtos","threadx"],"first_public_at":"2026-11-01T17:32:25+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115215","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115215","severity":null,"published_at":"2026-11-02T22:17:18+00:00","modified_at":"2026-11-02T22:17:18+00:00","first_seen_at":"2026-11-02T22:35:42+00:00","fetched_at":"2026-11-02T22:35:42+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115215:1438","url":null,"severity":null,"published_at":"2026-11-02T22:38:50+00:00","modified_at":"2026-11-02T22:38:50+00:00","first_seen_at":"2026-11-02T22:38:50+00:00","fetched_at":"2026-11-02T22:38:50+00:00","note":"Read Eclipse ThreadX GHSA-3p2g-x7hh-3w4c and release page: fixed in 6.5.2.202603b; affected >=6.0 <=6.5.2.202603a. No exploitation or PoC mentioned."}],"documents":[{"id":54164,"url":"https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-3p2g-x7hh-3w4c","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-01T17:32:25+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":2478,"url":"https://github.com/eclipse-threadx/netxduo/releases","title":"NetX Duo release v6.5.2.202603b_rel","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}