Eclipse NetX Duo versions up to 6.5.1 require urgent review of TLS 1.3 memory handling

Eclipse NetX Duo versions up to 6.5.1.202602 contain a critical vulnerability in their TLS 1.3 client implementation. This flaw allows malicious servers to overwrite memory buffers without presenting valid certificates.

What happened

According to the NVD record, the issue stems from how the client processes HelloRetryRequest messages. When a TLS 1.3 client receives this request, it copies the server's cookie into its second ClientHello message. The client fails to verify that the cookie fits within the outgoing packet buffer.

Both the length and content of the cookie originate from the peer server. The write operation occurs before certificate authentication is completed. A malicious or compromised server can exploit this to overwrite memory past the caller-supplied TLS packet buffer. This happens without the server needing to present a valid certificate.

Why it matters

The vulnerability is classified as Critical with a CVSS score of 9.3. It leverages CWE-787, which involves out-of-bounds write vulnerabilities. Only the client path is affected, meaning servers running NetX Duo are not directly vulnerable to this specific attack vector.

The risk is significant because the attack occurs before authentication. This allows an attacker to overwrite memory past the buffer. Teams must verify if their infrastructure uses affected versions of the library.

What to watch

• Monitor Eclipse Foundation announcements for a patch release.
• Check internal logs for unusual TLS handshake failures.
• Review network traffic for unexpected HelloRetryRequest patterns.
• Assess exposure of client applications using NetX Duo libraries.

Who needs to act first

Teams should prioritize inventorying systems that run client applications built with NetX Duo. Focus on internet-facing clients first, as they are most likely to encounter malicious servers. Once an update is available, test it in a isolated environment before deploying broadly. Back up configuration files and certificates to ensure recovery options exist. Reduce exposure by restricting outbound TLS connections to trusted domains where possible.

Background: CVSS score

The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.

Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes

What to do and how to stay safe: Eclipse NetX Duo

• Scan your software bill of materials for NetX Duo versions up to 6.5.1.202602.
• Implement strict outbound firewall rules to limit TLS connections to known servers.
• Monitor application logs for crashes or memory errors during TLS handshakes.
• Prepare an incident response plan for potential remote code execution scenarios.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVE ID for this vulnerability?

The CVE ID is CVE-2026-103415.

Which versions of NetX Duo are affected?

Versions up to 6.5.1.202602 are affected.

Is there a patch available for this issue?

The source material does not state whether a patch exists.