Description
An unauthenticated client can drain the RTSP server's packet pool with a couple of dozen requests



that carry a Session header the parser cannot convert.



The Session branch returns the raw NetX error code instead of an RTSP status code:



```c



/* addons/rtsp/nx_rtsp_server.c:2754 */



status = _nx_utility_string_to_uint(field_value_ptr, field_value_length, &session_id);



if (status)



{

return(status); /* NX_INVALID_PARAMETERS / NX_SIZE_ERROR / NX_OVERFLOW */


}



```



Every other branch of the same function maps its failure to an RTSP status first. The CSeq branch



eighteen lines earlier does exactly that (line 2736 returns NX_RTSP_STATUS_CODE_BAD_REQUEST). The



raw code then reaches `_nx_rtsp_server_error_response_send` (nx_rtsp_server.c:1234), which does not



recognise it, takes a path that returns without releasing the response packet it already allocated,



and the block never goes back to the pool.



Six requests with an empty Session header against a 22 packet pool:



```



valid requests: after request 6: pool available = 21, AFTER = 22 / 22



malformed requests: after request 6: pool available = 16, AFTER = 17 / 22



```



One block per request, not returned when the client disconnects. Twenty six requests take the pool



to zero and the server starts failing allocations, after which it serves nobody. If the pool is



shared with the rest of the application, as it is in the shipped sample, the rest of the stack



stops with it.



Convert the `_nx_utility_string_to_uint` failure in the Session branch into



NX_RTSP_STATUS_CODE_BAD_REQUEST the way the CSeq branch does, and release the response packet on



every exit path of `_nx_rtsp_server_error_response_send`.
Published: 2026-09-29
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch Immediately
AI Analysis

Impact

An unauthenticated client can send a small number of malformed RTSP requests containing a problematic Session header. The server parser fails to convert the header and returns a raw NetX error code, which bypasses proper RTSP error mapping. The error path does not release the allocated response packet, causing the packet pool to be drained. When the pool is exhausted the server cannot allocate new packets, leading to failure of RTSP handling and, if the pool is shared, causing the entire application stack to stop. The weakness is a memory leak that results in a denial of service condition.

Affected Systems

Vendors and products affected include Eclipse Foundation's ThreadX/NetXDuO RTSP server. The vulnerability is present in the RTSP server component of the NetXDuO library. At this time, the specific versions impacted are not disclosed in the advisory, and the advisory does not specify an exact version range. Administrators should check the vendor’s official advisory for the applicable component version.

Risk and Exploitability

The CVSS score of 8.7 indicates high severity. EPSS score is not provided, but no known exploit has been reported and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector is an unauthenticated external client that can send RTSP requests over the network. An attacker who can reach the RTSP port could trigger the packet pool exhaustion and cause service disruption. Because the flaw is triggered by simple malformed requests, it is relatively easy to automate. However, the vulnerability does not allow code execution or escalation of privileges.

Generated by OpenCVE AI on September 29, 2026 at 21:58 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor‑provided patch or upgrade to a NetXDuO version that includes the fix which converts Session‑branch errors to proper RTSP status codes and releases response packets.
  • If a patch is not yet available, disable or secure the RTSP service by requiring authentication or blocking the RTSP port from untrusted networks.
  • Monitor RTSP traffic for repeated malformed requests and configure rate‑limiting or a watchdog that restarts the RTSP service when packet‑pool usage exceeds a safe threshold.

Generated by OpenCVE AI on September 29, 2026 at 21:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 29 Sep 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Eclipse
Eclipse threadx Netx Duo
Vendors & Products Eclipse
Eclipse threadx Netx Duo

Tue, 29 Sep 2026 22:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated RTSP Requests Can Drain Packet Pool Causing Denial of Service

Tue, 29 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 29 Sep 2026 18:00:00 +0000

Type Values Removed Values Added
Description An unauthenticated client can drain the RTSP server's packet pool with a couple of dozen requests that carry a Session header the parser cannot convert. The Session branch returns the raw NetX error code instead of an RTSP status code: ```c /* addons/rtsp/nx_rtsp_server.c:2754 */ status = _nx_utility_string_to_uint(field_value_ptr, field_value_length, &session_id); if (status) { return(status); /* NX_INVALID_PARAMETERS / NX_SIZE_ERROR / NX_OVERFLOW */ } ``` Every other branch of the same function maps its failure to an RTSP status first. The CSeq branch eighteen lines earlier does exactly that (line 2736 returns NX_RTSP_STATUS_CODE_BAD_REQUEST). The raw code then reaches `_nx_rtsp_server_error_response_send` (nx_rtsp_server.c:1234), which does not recognise it, takes a path that returns without releasing the response packet it already allocated, and the block never goes back to the pool. Six requests with an empty Session header against a 22 packet pool: ``` valid requests: after request 6: pool available = 21, AFTER = 22 / 22 malformed requests: after request 6: pool available = 16, AFTER = 17 / 22 ``` One block per request, not returned when the client disconnects. Twenty six requests take the pool to zero and the server starts failing allocations, after which it serves nobody. If the pool is shared with the rest of the application, as it is in the shipped sample, the rest of the stack stops with it. Convert the `_nx_utility_string_to_uint` failure in the Session branch into NX_RTSP_STATUS_CODE_BAD_REQUEST the way the CSeq branch does, and release the response packet on every exit path of `_nx_rtsp_server_error_response_send`.
Weaknesses CWE-401
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Eclipse Threadx Netx Duo
cve-icon MITRE

Status: PUBLISHED

Assigner: eclipse

Published:

Updated: 2026-09-29T18:41:10.594Z

Reserved: 2026-09-29T16:15:12.001Z

Link: CVE-2026-102716

cve-icon Vulnrichment

Updated: 2026-09-29T18:41:02.637Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-29T18:17:10.943

Modified: 2026-09-29T19:17:20.780

Link: CVE-2026-102716

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-29T23:00:16Z

Weaknesses
  • CWE-401

    Missing Release of Memory after Effective Lifetime