{"id":"CVE-2026-94018","kind":"vulnerability","aliases":["CVE-2026-94018"],"related":[],"title":"Web add-on HTTP server: one malformed PUT frees an uninitialized pointer","description":"The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a `Content-Length` underflow while processing a `PUT` request. The condition is reachable by an unauthenticated remote client with a single malformed request.","summary":"Eclipse ThreadX NetX Duo's Web add-on HTTP server (_nx_web_http_server_put_process) releases an uninitialized packet pointer when a PUT body exceeds Content-Length (ULONG underflow). Default builds: likely crash (DoS). Builds with NX_DISABLE_ERROR_CHECKING: packet pool corruption. Unauthenticated only if the app registers no auth callback for PUT. Legacy addons/http server is not affected.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"NetX Duo","fixed":["6.5.2.202603"],"affected":">= 6.4.2, <= 6.5.1.202602","ecosystem":"vendor"}],"ecosystems":[],"tags":["eclipse-threadx","embedded","http-server","iot","memory-safety","netx-duo","other","rtos","web-add-on"],"not_affected_if":["auth-required","legacy-http-addon","no-web-addon","put-disabled"],"how_to_check":"Check whether your firmware uses NetX Duo with addons/web (nx_web_http_server.c) compiled in, serves PUT requests, and is a version >= 6.4.2 and <= 6.5.1.202602. Check whether NX_DISABLE_ERROR_CHECKING is defined (higher impact) and whether a PUT authentication callback is registered.","fix":"Upgrade NetX Duo to 6.5.2.202603. Workarounds: do not serve PUT requests, require authentication for PUT, restrict network access to the HTTP server, and leave NetX Duo error checking enabled (the default).","status":"open","published_at":"2026-10-20T16:17:17+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-23T22:32:51+00:00","updated_at":"2026-10-24T00:12:38+00:00","category":"other","confidence":0.9,"triage":{"at":"2026-10-23T22:32:51Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Web add-on HTTP server: one malformed PUT frees an uninitialized pointer","impact":"high","summary":"The Web add-on's HTTP server dereferences and releases an uninitialized pointer when a PUT request has a Content-Length underflow. A remote client with no account can trigger it with a single malformed request.","category":"other","who_cares":["web-add-on"],"confidence":0.5,"needs_auth":"no","worst_case":"memory corruption reachable by one unauthenticated malformed request","analyst_note":"Identify the product and vendor behind the 'Web add-on' and find its fixed version and any workaround at the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-94018 or the vendor advisory.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000744,"input_tokens":2894,"output_tokens":909,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the product and vendor behind the 'Web add-on' and find its fixed version and any workaround at the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-94018 or the vendor advisory.","search":"'-2026':15A,18A '-94018':16A,19A 'add':3A,40B,48B,107C 'add-on':2A,47B,106C 'addons/http':99B 'affect':103B 'app':91B 'auth':94B 'bodi':66B 'build':74B,78B 'callback':95B 'check':83B 'client':139C 'condit':132C 'content':69B,123C 'content-length':68B,122C 'corrupt':86B 'crash':76B 'cve':14A,17A 'default':73B 'derefer':112C 'detect':120C 'disabl':81B 'dos':77B 'duo':21A,35B,44B 'eclips':23B,41B 'eclipse-threadx':22B 'embed':25B 'error':82B 'exceed':67B 'free':10A 'http':5A,27B,50B,54B,110C 'http-server':26B 'iot':29B 'legaci':98B 'length':70B,124C 'like':75B 'malform':8A,143C 'memori':31B 'memory-safeti':30B 'netx':20A,34B,43B 'netx-duo':33B 'nx':52B,80B 'one':7A 'packet':61B,84B 'pointer':13A,62B,117C 'pool':85B 'process':57B,127C 'put':9A,56B,65B,97B,129C 'reachabl':134C 'regist':92B 'releas':58B,114C 'remot':138C 'request':130C,144C 'rtos':37B 'safeti':32B 'server':6A,28B,51B,55B,100B,111C 'singl':142C 'threadx':24B,42B 'ulong':71B 'unauthent':87B,137C 'underflow':72B,125C 'uniniti':12A,60B,116C 'web':1A,39B,46B,53B,105C 'web-add-on':38B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T16:17:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-94018","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94018","severity":null,"published_at":"2026-10-20T16:17:17+00:00","modified_at":"2026-10-20T19:48:50+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-94018:611","url":null,"severity":null,"published_at":"2026-10-24T00:12:38+00:00","modified_at":"2026-10-24T00:12:38+00:00","first_seen_at":"2026-10-24T00:12:38+00:00","fetched_at":"2026-10-24T00:12:38+00:00","note":"Product is Eclipse ThreadX NetX Duo Web add-on; read vendor GHSA-wjxf-gjm5-jh5q. No exploitation or PoC found (Feedly/VulDB say none); X not searched, niche embedded issue. Vendor CVSS 3.1 is 8.2; CVE record says 8.8 (CVSS 4.0). Severity left unchanged."}],"documents":[{"id":2475,"url":"https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-wjxf-gjm5-jh5q","title":"GHSA-wjxf-gjm5-jh5q NetX Duo Web HTTP server uninitialized packet pointer (PUT)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}