CVE-2026-102728

Awaiting Analysis Awaiting Analysis - Queue

NetX Secure TLS/DTLS Handshake Parser Out-of-Bounds Read

Publication date: 2026-09-29

Last updated on: 2026-11-04

Assigner: Eclipse Foundation

Description

In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure TLS client's ServerHello parser and DTLS client's HelloVerifyRequest parser read fields before checking that the message is long enough to contain them. A malicious server or an on-path attacker can make the client read up to three bytes past a handshake message, which can fault the client on targets with memory protection.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-11-04

Generated

2026-11-08

AI Q&A

2026-09-29

EPSS Evaluated

2026-11-07

NVD

CVE-2026-102728

EUVD

EUVD-2026-89195

Affected Vendors & Products

Vendor	Product	Version / Range
eclipse	netx_secure	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-126	The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.

Attack-Flow Graph

Executive Summary

This vulnerability involves two client-side TLS/DTLS handshake parsers in NetX Secure that read fields from a server message before validating if the message is long enough. This leads to bounded out-of-bounds reads, which can be exploited remotely by a malicious or malformed server targeting a TLS or DTLS client.

Detection Guidance

This vulnerability involves client-side TLS/DTLS handshake parsers in NetX Secure reading fields before validating message length. Detection requires inspecting network traffic for malformed TLS/DTLS handshake messages or monitoring systems running NetX Secure for unexpected behavior during client-server connections.

Impact Analysis

This vulnerability could allow an attacker to read sensitive memory contents on your system by sending a specially crafted server message during a TLS/DTLS handshake. This may lead to information disclosure or potential further exploitation depending on the system configuration.

Compliance Impact

The vulnerability involves out-of-bounds reads in TLS/DTLS handshake parsers, which could lead to information disclosure or crashes. This may impact compliance with GDPR by potentially exposing sensitive data during transmission, and with HIPAA by risking unauthorized access to protected health information during client-server communication.

Mitigation Strategies

Update NetX Secure to the latest patched version to address the out-of-bounds read issues in TLS/DTLS handshake parsers. Monitor vendor advisories for patches and apply them promptly.

Hi! I’m here to help you understand CVE-2026-102728. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...