CVE-2026-11576
Received Received - Intake
HTTP Server PUT Error Handling Flaw in Eclipse ThreadX NetX Duo

Publication date: 2026-06-19

Last updated on: 2026-06-19

Assigner: Eclipse Foundation

Description
The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this unified cleanup path unconditionally calls fx_file_close() even when the file was never successfully opened. Multiple error branches jump to the shared cleanup label before any file open operation has occurred, causing fx_file_close() to operate on an uninitialized file handle, leading to undefined behavior, double-close issues, or memory corruption.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-19
Last Modified
2026-06-19
Generated
2026-06-19
AI Q&A
2026-06-19
EPSS Evaluated
N/A
NVD
CVE-2026-11576
EUVD
EUVD-2026-37999
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
eclipse threadx *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-459 The product does not properly "clean up" and remove temporary or supporting resources after they have been used.
CWE-908 The product uses or accesses a resource that has not been initialized.
CWE-415 The product calls free() twice on the same memory address.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability arises from a flaw in the error handling of the HTTP server PUT process in eclipse-threadx NetX Duo. Specifically, a security fix for a previous vulnerability (CVE-2025-0728) refactored the code to use a shared cleanup label that always calls the function fx_file_close(). However, this function is called even when a file was never successfully opened. As a result, multiple error paths jump to this cleanup code before any file open operation occurs, causing fx_file_close() to operate on an uninitialized file handle. This leads to undefined behavior such as double-close issues or memory corruption.

Impact Analysis

The vulnerability can cause undefined behavior in the affected system, including double-close issues and memory corruption. These impacts can lead to system instability, crashes, or potential exploitation by attackers to disrupt service availability.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-11576. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart