Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-106464

Quick assessment

Affected
Eclipse Foundation NetX Duo
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在计算证书签名的长度时，直接使用 ，但未首先检查 是否为零。因此，当证书的签名为空的 ASN.1 BIT STRING 时，解析过程会成功完成，导致证书持有签名长度值 ，以及指向缓冲区末尾之后一个字节的签名指针。由于证书是在 TLS 握手期间从对端解析的，因此输入数据来自远程且未经身份验证。

CVSS 8.7 · High EPSS 0.18% · P7

Affected Version Matrix 2

VendorProduct Version RangeStatus
Eclipse Foundation NetX Duo ≤ 6.5.2.202603 affected
6.5.2.202603a unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-106464

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
`_nx_secure_x509_parse_signature_data` computes the certificate signature's length as `tlv_length - 1` without first checking that `tlv_length` is non-zero. A certificate whose signature is an empty ASN.1 BIT STRING therefore parses successfully and leaves the certificate holding a signature length of `0xFFFFFFFF` and a signature pointer one byte past the end of the buffer. Certificates are parsed from the peer during the TLS handshake, so the input is remote and unauthenticated.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Eclipse Foundation NetX Duo 0 ~ 6.5.2.202603 -

II. Public POCs for CVE-2026-106464

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-106464

请登录查看更多情报信息。

Other References for CVE-2026-106464 (2)

Same Patch Batch · Eclipse Foundation · 2026-10-14 · 8 CVEs total

CVE-2026-103415 9.3 CRITICAL TLS 1.3 客户端缓冲区溢出漏洞
CVE-2026-102476 9.1 CRITICAL Eclipse Vert.x SSL缓存绕过漏洞
CVE-2026-106465 8.7 HIGH NetX Secure DTLS服务器存在绕过验证漏洞
CVE-2026-102479 8.7 HIGH Vert.x 5.0-5.2 HTTP请求走私漏洞
CVE-2026-102460 8.6 HIGH CVE-2026-102460
CVE-2026-103414 8.4 HIGH GUIX二进制资源加载器缓冲区溢出漏洞
CVE-2026-102471 6.9 MEDIUM CRLF header injection in vertx-mail-client allows manipulation of outgoing SMTP messages

IV. Related Vulnerabilities

Same product: NetX Duo
Same vendor: Eclipse Foundation
Same weakness: CWE-125

V. Comments for CVE-2026-106464

No comments yet

Leave a comment