Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-115215— NetX Secure DTLS server allocates a session for each new source before the cookie exchange and never reclaims it, so spoofed datagrams exhaust the session pool

Quick assessment

Affected
Eclipse Foundation Eclipse ThreadX
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Eclipse ThreadX NetX Duo 的 6.0 至 6.5.2.202603a 版本中，NetX Secure DTLS 服务器会在执行 Cookie 交换之前，为来自任何未知地址和端口的首个数据报从其固定会话池中分配一个会话，且永远不会释放因握手停滞而占用的会话。远程未认证攻击者可以通过为每个源地址发送一个伪造数据报来耗尽该会话池，从而在应用程序重置会话之前，拒绝合法客户端使用 DTLS 服务。

CVSS 8.7 · High

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-115215

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
NetX Secure DTLS server allocates a session for each new source before the cookie exchange and never reclaims it, so spoofed datagrams exhaust the session pool
Source: CVE Program / CVE List V5
Vulnerability Description
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server allocates a session from its fixed session pool for the first datagram from any unrecognised address and port, before the cookie exchange, and never releases a session whose handshake stalls. A remote, unauthenticated attacker can exhaust the pool with one spoofed datagram per source and deny DTLS service to legitimate clients until the application resets the sessions.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Eclipse Foundation Eclipse ThreadX 6.0 ~ 6.5.2.202603a -

II. Public POCs for CVE-2026-115215

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-115215

请登录查看更多情报信息。

Other References for CVE-2026-115215 (2)

Same Patch Batch · Eclipse Foundation · 2026-11-02 · 6 CVEs total

CVE-2026-114408 8.7 HIGH NULL pointer dereference in ICMPv6 Packet Too Big processing when the destination table is
CVE-2026-115403 8.2 HIGH NULL pointer dereference in the BSD raw IPv6 send path when the destination table is full
CVE-2026-115653 7.0 HIGH Cortex-M module ports save a preempted user-mode module thread's registers through its unc
CVE-2026-115654 6.9 MEDIUM User-mode module can suspend, terminate, re-prioritise and abort the waits of threads it d
CVE-2026-118052 6.8 MEDIUM Module Manager loaders leave the manager mutex held when a module preamble's sizes overflo

IV. Related Vulnerabilities

Same product: Eclipse ThreadX
Same vendor: Eclipse Foundation
Same weakness: CWE-770