CVE-2026-102716

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-09-29

Last updated on: 2026-11-04

Assigner: Eclipse Foundation

Description

In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the RTSP server returns a raw parser error for a malformed Session header and never releases the response packet it allocated. An unauthenticated client can drain the server's packet pool with a few dozen requests, stopping the RTSP server and, where the pool is shared, the rest of the network stack until the device restarts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-11-04

Generated

2026-11-08

AI Q&A

2026-09-29

EPSS Evaluated

2026-11-07

NVD

CVE-2026-102716

EUVD

EUVD-2026-89180

Affected Vendors & Products

Vendor	Product	Version / Range
Eclipse Foundation	eclipse-threadx/netxduo	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-755	The product does not handle or incorrectly handles an exceptional condition.
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Executive Summary

This vulnerability allows an unauthenticated client to exhaust the RTSP server's packet pool by sending malformed requests with an empty or invalid Session header. The server fails to properly handle these requests, causing allocated packet blocks to remain unreleased and eventually deplete the pool.

Detection Guidance

Monitor RTSP server packet pool exhaustion by tracking available packets. Check server logs for repeated malformed Session header errors. Use network traffic analysis tools like Wireshark to detect excessive RTSP requests with empty or invalid Session headers.

Impact Analysis

If exploited, this vulnerability can crash the RTSP server by starving it of available packet blocks. If the pool is shared with other parts of the application, the entire system may become unresponsive or fail, leading to denial of service for all users.

Compliance Impact

This vulnerability causes a denial-of-service condition by exhausting the RTSP server's packet pool, leading to service unavailability. For GDPR, this could impact availability of processing systems, a key principle. For HIPAA, service disruption may affect access to protected health information systems.

Mitigation Strategies

Apply the vendor patch to convert Session header parsing errors to proper RTSP status codes and ensure response packets are released. Temporarily rate-limit RTSP requests or block clients sending malformed Session headers until patched.

Hi! I’m here to help you understand CVE-2026-102716. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...