CVE-2026-115215

Name of the Vulnerable Software and Affected Versions Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a

Description The NetX Secure DTLS server allocates a session from its fixed session pool upon receiving the first datagram from an unrecognized address and port, occurring before the cookie exchange. Because sessions with stalled handshakes are never released, a remote, unauthenticated attacker can exhaust the session pool by sending one spoofed datagram per source. This leads to a denial of service for legitimate DTLS clients until the application resets the sessions.

Recommendations Update Eclipse ThreadX NetX Duo to a version later than 6.5.2.202603a.