CVE-2026-103415

Awaiting Analysis Awaiting Analysis - Queue

TLS 1.3 Client Cookie Overflow in HelloRetryRequest

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: Eclipse Foundation

Description

When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without checking that the cookie fits in the outgoing packet. Both the length and the contents of that cookie come from the peer, and the write happens before certificate authentication completes, so a malicious or compromised server can overwrite memory past the caller supplied TLS packet buffer without presenting a certificate. Only the client path is affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-103415

EUVD

EUVD-2026-101501

Affected Vendors & Products

Vendor	Product	Version / Range
Eclipse	Foundation	NetX Duo 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

CVE-2026-103415 is an out-of-bounds write vulnerability in NetX Duo TLS 1.3 clients. When a client receives a HelloRetryRequest, it copies a server-provided cookie into a second ClientHello packet without checking if the cookie fits in the buffer. The cookie's length and content are controlled by the peer, allowing a malicious server to overwrite memory beyond the TLS packet buffer before certificate authentication completes. This can lead to memory corruption or arbitrary code execution.

Detection Guidance

To detect this vulnerability, check if your NetX Duo TLS 1.3 client is using versions 6.0 through 6.5.1.202602 with ECC ciphersuites enabled. Inspect network traffic for malformed TLS 1.3 HelloRetryRequest messages with oversized cookies. Use packet capture tools like Wireshark to analyze TLS handshake packets for abnormal cookie lengths.

Impact Analysis

If you use NetX Duo TLS 1.3 clients with versions 6.0 through 6.5.1.202602 and ECC ciphersuites enabled, a malicious server could exploit this to overwrite memory, potentially causing crashes, arbitrary code execution, or data corruption. The attack requires no user interaction or privileges and occurs during a standard TLS handshake.

Compliance Impact

This vulnerability could lead to arbitrary code execution or memory corruption, which may result in unauthorized access to sensitive data. For GDPR, this could violate principles of data protection and confidentiality. For HIPAA, it might compromise the integrity and security of protected health information.

Mitigation Strategies

Immediately upgrade NetX Duo to version 6.5.2.202603 or later. Disable TLS 1.3 and ECC ciphersuites if upgrading is not possible. Monitor network traffic for suspicious TLS handshake attempts. Apply network-level protections to block malformed TLS packets.

Hi! I’m here to help you understand CVE-2026-103415. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70