CVE-2026-106465

Awaiting Analysis Awaiting Analysis - Queue

NetX Secure DTLS Server Cookie Verification Bypass

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: Eclipse Foundation

Description

The NetX Secure DTLS server sends a HelloVerifyRequest carrying a freshly generated cookie, but never checks the cookie a client returns. The ClientHello parser copies the client's cookie bytes over the value the server issued, and the server then decides whether the client has been verified from the cookie's length alone. A peer that puts any single cookie byte in its first ClientHello skips the verification exchange entirely, so the server has no return-routability check and completes handshakes for forged source addresses.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106465

EUVD

EUVD-2026-101504

Affected Vendors & Products

Vendor	Product	Version / Range
Eclipse	Foundation	NetX Duo 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-406	The product does not sufficiently monitor or control transmitted network traffic volume, so that an actor can cause the product to transmit more traffic than should be allowed for that actor.
CWE-290	This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

Executive Summary

The NetX Secure DTLS server sends a HelloVerifyRequest with a randomly generated cookie but fails to validate the cookie returned by the client. Instead, it overwrites the issued cookie with the client's cookie and only checks the cookie's length. An attacker can forge a ClientHello with a single-byte cookie, bypassing verification and completing a DTLS handshake from a spoofed source address.

Detection Guidance

Detecting this vulnerability requires checking if your NetX Duo DTLS server is running a vulnerable version (up to 6.5.2.202603). Inspect server logs for unusual ClientHello exchanges or session exhaustion patterns. Use network monitoring tools to detect traffic amplification from spoofed addresses.

Impact Analysis

This vulnerability enables two main attacks: session pool exhaustion, where forged ClientHellos consume limited session slots on the server, denying service to legitimate clients, and traffic amplification, where a small forged packet from a victim's address triggers a large response from the server, potentially overwhelming third-party systems.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that disrupt service availability, potentially violating requirements for data access, processing, or security controls. The session exhaustion and traffic amplification risks may lead to unauthorized resource consumption or service disruptions, which could be considered failures in maintaining system integrity and availability under these regulations.

Mitigation Strategies

Upgrade NetX Duo to version 6.5.2.202603a or later to fix the cookie validation issue. If upgrading is not immediately possible, implement ingress filtering to block spoofed source addresses and set session limits to reduce exposure to session pool exhaustion attacks.

Hi! I’m here to help you understand CVE-2026-106465. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70