CVE-2026-106465

Name of the Vulnerable Software and Affected Versions NetX Secure (affected versions not specified)

Description The DTLS server fails to properly validate the cookie returned by a client after sending a HelloVerifyRequest. The ClientHello parser overwrites the server-issued cookie value with the bytes provided by the client, and the server determines verification status based solely on the length of the cookie. Consequently, a peer providing any single cookie byte in the initial ClientHello can bypass the verification exchange, allowing the server to complete handshakes for forged source addresses due to the lack of a return-routability check.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.