The NetX Duo Web HTTP server contains a request parsing flaw that causes it to treat any header field name placed in the request body as a legitimate HTTP header. This means a client can insert header fields after the actual header section, altering how the server interprets the request. This flaw is a CWE-444 weakness, as it allows a client to inject header fields into the request body. Such manipulation could lead to request smuggling, header injection, or subversion of server logic, potentially allowing unauthorized actions or causing denial of service.

The affected product is Eclipse Foundation’s Eclipse ThreadX NetX Duo Web HTTP server. No specific version information was supplied in the advisory, so all releases of the NetX Duo Web add‑on may be vulnerable unless explicitly excluded.

The CVSS score of 6.9 indicates a medium severity. The exploit database does not list a known active exploitation or EPSS data, and the vulnerability is not in the CISA KEV catalog. An attacker only needs to send a crafted HTTP request to the vulnerable server; no authentication is required. The risk is moderate but could be exploited from anywhere that can reach the HTTP interface. Applying a patch mitigates the issue immediately.