The Web add‑on’s HTTP server violates memory safety by dereferencing and freeing an uninitialized pointer when processing a PUT request that contains a Content‑Length underflow. This flaw can corrupt heap memory and potentially allow an attacker to execute arbitrary code or crash the application. The vulnerability is a classic instance of uninitialized pointer usage and buffer underflow as defined by CWE‑457 and CWE‑824.

The flaw exists in the Eclipse ThreadX NetX Duo Web HTTP server provided by the Eclipse Foundation. No specific version numbers were supplied in the advisory, so all releases of the NetX Duo Web add‑on that implement the described HTTP parsing logic should be considered potentially vulnerable.

An unauthenticated remote client can trigger the flaw by sending a single malformed PUT request. The CVSS score of 8.8 indicates a high severity level, and while the EPSS score is not available, the absence of a KEV listing does not reduce the likelihood of exploitation. The attack vector is network‑based, requiring the ability to reach the host’s HTTP port. The exploit requires minimal setup and can be performed remotely, making it a significant threat for exposed systems.