The NetX Duo Secure DTLS server allocates a session pool entry for every first datagram from an unknown source before completing the cookie exchange and never releases a session whose handshake stalls. An attacker can send a spoofed datagram from an arbitrary source to consume one session per source, running out of available sessions and preventing legitimate clients from completing DTLS handshakes. The flaw is a resource exhaustion vulnerability that can be exploited by an unauthenticated attacker, giving them a full denial of service against the secure DTLS endpoint.

The vulnerability affects Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a. Any deployment of these images that uses the DTLS server with the default fixed-size session pool is impacted. The issue is limited to the NetX Secure DTLS server component in these product releases.

The CVSS score of 8.7 indicates high severity, and EPSS is not yet available, suggesting limited exploitation data. The flaw is listed in no KEV catalog. The likely attack vector is network-based: an unauthenticated attacker must send a spoofed UDP datagram over the DTLS public port before the cookie exchange. If the attacker can generate many unique source addresses, they can exhaust the finite session pool and force the server to deny service. No solution or workaround is currently provided by the CNA, so the vulnerability remains exploitable until a vendor patch is released.