BaseFortify

Publication date: 2025-10-17

Last updated on: 2025-10-27

Assigner: Eclipse Foundation

Description

In NextX Duo before 6.4.4, in the HTTP client module, the network support code for Eclipse Foundation ThreadX, the parsing of HTTP header fields was missing bounds verification. A crafted server response could cause undefined behavior.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-17

Last Modified

2025-10-27

Generated

2026-07-06

AI Q&A

2025-10-17

EPSS Evaluated

2026-07-05

NVD

CVE-2025-55085

Affected Vendors & Products

Vendor	Product	Version / Range
eclipse	threadx_netx_duo	to 6.4.4.202503 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1286	The product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax.
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability exists in NextX Duo versions before 6.4.4 within the HTTP client module's network support code for Eclipse Foundation ThreadX. Specifically, the parsing of HTTP header fields lacks bounds verification, which means that a crafted server response could cause undefined behavior in the client.

Impact Analysis

The vulnerability could lead to undefined behavior when processing maliciously crafted HTTP headers from a server. This might result in crashes, unexpected behavior, or potentially exploitable conditions that could compromise the affected system's stability or security.

Hi! I’m here to help you understand CVE-2025-55085. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70