Description
Two client-side TLS/DTLS handshake parsers in NetX Secure read fields from a server-supplied message before validating that the message is long enough to contain them. Both are bounded out-of-bounds reads on a remotely reachable path, both are reached from a TLS or DTLS client connecting to a malicious or malformed server, and both have the same shape: the bounds check exists and returns the correct status, but it runs after the read it is meant to guard.
Published:
2026-09-29
Score:
n/a
EPSS:
n/a
KEV:
No
Impact:
n/a
Action:
n/a
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Eclipse Foundation | NetX Duo | unaffected |
|
No data.
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
No advisories yet.
References
History
Tue, 29 Sep 2026 18:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Two client-side TLS/DTLS handshake parsers in NetX Secure read fields from a server-supplied message before validating that the message is long enough to contain them. Both are bounded out-of-bounds reads on a remotely reachable path, both are reached from a TLS or DTLS client connecting to a malicious or malformed server, and both have the same shape: the bounds check exists and returns the correct status, but it runs after the read it is meant to guard. | |
| Weaknesses | CWE-126 | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: eclipse
Published:
Updated: 2026-09-29T17:55:18.761Z
Reserved: 2026-09-29T16:15:22.319Z
Link: CVE-2026-102728
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-09-29T18:17:12.497
Modified: 2026-09-29T19:00:16.623
Link: CVE-2026-102728
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
-
CWE-126
Buffer Over-read