CVE-2026-94018
Awaiting Analysis Awaiting Analysis - Queue

HTTP Server Uninitialized Pointer Dereference in Web Add-on

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: Eclipse Foundation

Description
The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a `Content-Length` underflow while processing a `PUT` request. The condition is reachable by an unauthenticated remote client with a single malformed request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-11-10
AI Q&A
2026-10-20
EPSS Evaluated
2026-11-08
NVD
CVE-2026-94018
EUVD
EUVD-2026-105132

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Eclipse Foundation Eclipse ThreadX - NetX Duo 6.4.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-457 The code uses a variable that has not been initialized, leading to unpredictable or unintended results.
CWE-824 The product accesses or uses a pointer that has not been initialized.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-94018 is a vulnerability in the NetX Duo Web HTTP server where an uninitialized pointer is released when processing a PUT request with a Content-Length underflow. The pointer `data_packet_ptr` is declared without initialization and later dereferenced in error paths before being properly assigned. An unauthenticated remote attacker can exploit this by sending a malformed PUT request, causing either a crash or packet pool corruption.

Detection Guidance

To detect this vulnerability, monitor for crashes or memory corruption in the NetX Duo Web HTTP server when processing PUT requests with malformed Content-Length headers. Check server logs for segmentation faults or pool corruption errors. Ensure your NetX Duo version is below 6.5.2.202603.

Impact Analysis

This vulnerability can lead to denial of service (DoS) or remote code execution (RCE) due to packet pool corruption or server crashes. An attacker could exploit it to disrupt services or gain unauthorized access to the system.

Compliance Impact

This vulnerability could lead to denial of service or remote code execution due to memory corruption, which may compromise data integrity and availability. Such impacts could violate compliance requirements under GDPR (data integrity and availability) and HIPAA (security of protected health information).

Mitigation Strategies
  • Upgrade to NetX Duo 6.5.2.202603 or later to patch the vulnerability.
  • Disable PUT requests on the Web add-on HTTP server if upgrading is not immediately possible.
  • Enable default error checking in builds where it may have been disabled.
  • Implement authentication requirements for PUT requests to reduce attack surface.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94018. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...