CVE-2026-102716

A malformed Session header permanently orphans one packet-pool block per RTSP request

Published Sep 29, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Description

In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the RTSP server returns a raw parser error for a malformed Session header and never releases the response packet it allocated. An unauthenticated client can drain the server's packet pool with a few dozen requests, stopping the RTSP server and, where the pool is shared, the rest of the network stack until the device restarts.

Analysis

Technical impact

A malformed Session header in the Eclipse ThreadX NetX Duo RTSP server causes the server to return a raw parser error and never free the response packet that was allocated. Each such request orphans one packet‑pool block, which an unauthenticated attacker can exhaust with only a few dozen requests, rendering the RTSP service non‑responsive and, when the packet pool is shared, shutting down the entire network stack until the device is rebooted. The flaw is a memory‑leak style vulnerability that results in a service outage but does not provide code execution or privilege escalation.

Affected Systems

Eclipse ThreadX NetX Duo RTSP server versions up to and including 6.5.2.202603 are affected. Administrators should verify the deployed NetX Duo version and consider disabling or removing the RTSP component if the vendor fix is unavailable.

Risk and Exploitability

The CVSS score of 8.7 indicates a high‑severity problem, yet the EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated external client sending malformed RTSP Session headers over the network. Because the requisition consists of simple malformed requests, exploitation is relatively easy to automate; however, it achieves only a denial of service without elevating privileges.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Eclipse Foundation

Eclipse ThreadX NetX Duo

unaffected

Version	Status	Constraints
`0`	affected	≤ 6.5.2.202603
`6.5.2.202603a`	unaffected	—

No data.

Vendor Product Versions

Eclipse

Threadx Netx Duo

Version	Status	Scheme	Platform
`[0,6.5.1]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to a NetX Duo version released after 6.5.2.202603 or apply a vendor‑provided fix once it becomes available.
If an upgrade is not yet possible, disable or block the RTSP service on untrusted networks and secure the RTSP port with firewall rules or access control lists.
Monitor RTSP traffic for repeated malformed requests and enforce rate‑limiting or a watchdog that restarts the service when packet‑pool usage approaches exhaustion.

Generated by OpenCVE AI on November 4, 2026 at 15:07 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.253% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-q462-246c-x3jc

History

Nov 4, 2026 1:30 PM Description updated. Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Description	An unauthenticated client can drain the RTSP server's packet pool with a couple of dozen requests that carry a Session header the parser cannot convert. The Session branch returns the raw NetX error code instead of an RTSP status code: ```c /* addons/rtsp/nx_rtsp_server.c:2754 / status = _nx_utility_string_to_uint(field_value_ptr, field_value_length, &session_id); if (status) { return(status); / NX_INVALID_PARAMETERS / NX_SIZE_ERROR / NX_OVERFLOW */ } ``` Every other branch of the same function maps its failure to an RTSP status first. The CSeq branch eighteen lines earlier does exactly that (line 2736 returns NX_RTSP_STATUS_CODE_BAD_REQUEST). The raw code then reaches `_nx_rtsp_server_error_response_send` (nx_rtsp_server.c:1234), which does not recognise it, takes a path that returns without releasing the response packet it already allocated, and the block never goes back to the pool. Six requests with an empty Session header against a 22 packet pool: ``` valid requests: after request 6: pool available = 21, AFTER = 22 / 22 malformed requests: after request 6: pool available = 16, AFTER = 17 / 22 ``` One block per request, not returned when the client disconnects. Twenty six requests take the pool to zero and the server starts failing allocations, after which it serves nobody. If the pool is shared with the rest of the application, as it is in the shipped sample, the rest of the stack stops with it. Convert the `_nx_utility_string_to_uint` failure in the Session branch into NX_RTSP_STATUS_CODE_BAD_REQUEST the way the CSeq branch does, and release the response packet on every exit path of `_nx_rtsp_server_error_response_send`.	In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the RTSP server returns a raw parser error for a malformed Session header and never releases the response packet it allocated. An unauthenticated client can drain the server's packet pool with a few dozen requests, stopping the RTSP server and, where the pool is shared, the rest of the network stack until the device restarts.
Title	Unauthenticated RTSP Requests Can Drain Packet Pool Causing Denial of Service	A malformed Session header permanently orphans one packet-pool block per RTSP request
Weaknesses		CWE-755

Sep 29, 2026 11:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Eclipse Eclipse threadx Netx Duo
Vendors & Products		Eclipse Eclipse threadx Netx Duo

Sep 29, 2026 10:15 PM Title updated View changes

Type	Values Removed	Values Added
Title		Unauthenticated RTSP Requests Can Drain Packet Pool Causing Denial of Service

Sep 29, 2026 7:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 29, 2026 6:00 PM Description updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		An unauthenticated client can drain the RTSP server's packet pool with a couple of dozen requests that carry a Session header the parser cannot convert. The Session branch returns the raw NetX error code instead of an RTSP status code: ```c /* addons/rtsp/nx_rtsp_server.c:2754 / status = _nx_utility_string_to_uint(field_value_ptr, field_value_length, &session_id); if (status) { return(status); / NX_INVALID_PARAMETERS / NX_SIZE_ERROR / NX_OVERFLOW */ } ``` Every other branch of the same function maps its failure to an RTSP status first. The CSeq branch eighteen lines earlier does exactly that (line 2736 returns NX_RTSP_STATUS_CODE_BAD_REQUEST). The raw code then reaches `_nx_rtsp_server_error_response_send` (nx_rtsp_server.c:1234), which does not recognise it, takes a path that returns without releasing the response packet it already allocated, and the block never goes back to the pool. Six requests with an empty Session header against a 22 packet pool: ``` valid requests: after request 6: pool available = 21, AFTER = 22 / 22 malformed requests: after request 6: pool available = 16, AFTER = 17 / 22 ``` One block per request, not returned when the client disconnects. Twenty six requests take the pool to zero and the server starts failing allocations, after which it serves nobody. If the pool is shared with the rest of the application, as it is in the shipped sample, the rest of the stack stops with it. Convert the `_nx_utility_string_to_uint` failure in the Session branch into NX_RTSP_STATUS_CODE_BAD_REQUEST the way the CSeq branch does, and release the response packet on every exit path of `_nx_rtsp_server_error_response_send`.
Weaknesses		CWE-401
References		https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-q462-246c-x3jc
Metrics		cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`