CVE-2026-115403

The record

In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, built with BSD raw socket and IPv6 support, the IPv6 raw send path uses the destination-table entry it adds without checking that the add succeeded. When the destination table is full and an off-link destination is reached through a default router whose neighbour cache entry is unknown, sending on an IPv6 raw socket with header inclusion dereferences a NULL pointer; a remote sender can fill the table, for example with ICMPv6 Packet Too Big messages, and crash the sending thread.

Affected packages

Related vulnerabilities

• CVE-2026-114408 In Eclipse ThreadX NetX Duo versions 6.4.5.202504 through 6.5.2.202603a, built with IPv6… CWE-252
• CVE-2026-118263 Echo is a Go web framework. CWE-252
• CVE-2026-111497 A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli… CWE-252
• CVE-2026-110353 HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of… CWE-252
• CVE-2026-56388 The Redis server command parser in Apache bRPC accepts an empty RESP array as a command… CWE-252
• CVE-2026-106436 The BSON encoder in the MongoDB PHP Driver does not check some return values after a… CWE-252
• CVE-2026-98141 In the Linux kernel, the following vulnerability has been resolved: ntfs: propagate… CWE-252
• CVE-2026-98114 In the Linux kernel, the following vulnerability has been resolved: ksmbd: propagate DACL… CWE-252