Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-92843

Out-of-bounds Read via the TLS 1.3 Certificate extensions_length in NetX Secure

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
eclipse

Description

A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-of-bounds read in any peer that processes a remote Certificate message. It is reachable pre-authentication, during the normal handshake, before certificate verification completes.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Eclipse Foundation Eclipse ThreadX - NetX Duo

Default version status: unaffected

  • 0 to ≤ 6.5.1.202602affected
  • 6.5.2.202603unaffected

References