NetX Secure: TLS 1.3 Certificate parser reads heap memory out of bounds

NetX Secure's TLS 1.3 Certificate parser reads the per-certificate extensions_length unchecked; if it exceeds the remaining list, total_length underflows and the parser reads up to ~64 KiB past the buffer, pre-authentication, reachable by a rogue server, on-path attacker or rogue AP. Vendor-confirmed impact is a silent over-read or fault (DoS); bytes go to the DER parser, not back to the attacker. The same underflow could make the bad cert_length a copy size (possible out-of-bounds write); the vendor has not confirmed this. No known exploitation or public PoC.

Summary written from the sources below. Check the originals before acting.