How do I check whether I am affected by CVE-2026-94018?

Check whether your firmware uses NetX Duo with addons/web (nx_web_http_server.c) compiled in, serves PUT requests, and is a version >= 6.4.2 and <= 6.5.1.202602. Check whether NX_DISABLE_ERROR_CHECKING is defined (higher impact) and whether a PUT authentication callback is registered.

What is the fix for CVE-2026-94018?

Upgrade NetX Duo to 6.5.2.202603. Workarounds: do not serve PUT requests, require authentication for PUT, restrict network access to the HTTP server, and leave NetX Duo error checking enabled (the default).

Who is not affected by CVE-2026-94018?

Not affected if: auth-required, legacy-http-addon, no-web-addon, put-disabled.

Live › vulnerability › CVE-2026-94018

Go to dashboard

high8.8Other

Web add-on HTTP server: one malformed PUT frees an uninitialized pointer

Q: What is the fix for CVE-2026-94018?

Upgrade NetX Duo to 6.5.2.202603. Workarounds: do not serve PUT requests, require authentication for PUT, restrict network access to the HTTP server, and leave NetX Duo error checking enabled (the default).

Q: Who is not affected by CVE-2026-94018?

Not affected if: auth-required, legacy-http-addon, no-web-addon, put-disabled.

Eclipse ThreadX NetX Duo's Web add-on HTTP server (_nx_web_http_server_put_process) releases an uninitialized packet pointer when a PUT body exceeds Content-Length (ULONG underflow). Default builds: likely crash (DoS). Builds with NX_DISABLE_ERROR_CHECKING: packet pool corruption. Unauthenticated only if the app registers no auth callback for PUT. Legacy addons/http server is not affected.

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

8.8

high

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Oct 20, 2026 UTC
Last modified: Oct 24, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: No.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Memory corruption reachable by one unauthenticated malformed request.
CVSS said: 8.8. The facts above say critical; we keep the sources' high until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-94018

Go to dashboard

high8.8Other

Web add-on HTTP server: one malformed PUT frees an uninitialized pointer

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

8.8

high

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Oct 20, 2026 UTC
Last modified: Oct 24, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: No.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Memory corruption reachable by one unauthenticated malformed request.
CVSS said: 8.8. The facts above say critical; we keep the sources' high until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Web add-on HTTP server: one malformed PUT frees an uninitialized pointer

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

Web add-on HTTP server: one malformed PUT frees an uninitialized pointer

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources