CVE-2025-55085
BaseFortify
Publication date: 2025-10-17
Last updated on: 2025-10-27
Assigner: Eclipse Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| eclipse | threadx_netx_duo | to 6.4.4.202503 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1286 | The product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax. |
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in NextX Duo versions before 6.4.4 within the HTTP client module's network support code for Eclipse Foundation ThreadX. Specifically, the parsing of HTTP header fields lacks bounds verification, which means that a crafted server response could cause undefined behavior in the client.
How can this vulnerability impact me? :
The vulnerability could lead to undefined behavior when processing maliciously crafted HTTP headers from a server. This might result in crashes, unexpected behavior, or potentially exploitable conditions that could compromise the affected system's stability or security.