CVE-2026-11576

Analyzed Analyzed - Analysis Complete

HTTP Server PUT Error Handling Flaw in Eclipse ThreadX NetX Duo

Publication date: 2026-06-19

Last updated on: 2026-07-02

Assigner: Eclipse Foundation

Description

The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this unified cleanup path unconditionally calls fx_file_close() even when the file was never successfully opened. Multiple error branches jump to the shared cleanup label before any file open operation has occurred, causing fx_file_close() to operate on an uninitialized file handle, leading to undefined behavior, double-close issues, or memory corruption.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-19

Last Modified

2026-07-02

Generated

2026-07-09

AI Q&A

2026-06-19

EPSS Evaluated

2026-07-08

NVD

CVE-2026-11576

EUVD

EUVD-2026-37999

Affected Vendors & Products

Vendor	Product	Version / Range
eclipse	threadx_netx_duo	From 6.4.2 (inc) to 6.5.0.202601 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-459	The product does not properly "clean up" and remove temporary or supporting resources after they have been used.
CWE-908	The product uses or accesses a resource that has not been initialized.
CWE-415	The product calls free() twice on the same memory address.

Attack-Flow Graph

Executive Summary

This vulnerability arises from a flaw in the error handling of the HTTP server PUT process in eclipse-threadx NetX Duo. Specifically, a security fix for a previous vulnerability (CVE-2025-0728) refactored the code to use a shared cleanup label that always calls the function fx_file_close(). However, this function is called even when a file was never successfully opened. As a result, multiple error paths jump to this cleanup code before any file open operation occurs, causing fx_file_close() to operate on an uninitialized file handle. This leads to undefined behavior such as double-close issues or memory corruption.

Impact Analysis

The vulnerability can cause undefined behavior in the affected system, including double-close issues and memory corruption. These impacts can lead to system instability, crashes, or potential exploitation by attackers to disrupt service availability.

Compliance Impact

The provided information does not specify how this vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.

Hi! I’m here to help you understand CVE-2026-11576. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70