WebSocket Client Vulnerability in NetX Duo by Eclipse Foundation

CVE-2026-102761

What is CVE-2026-102761?

A vulnerability exists in the WebSocket client of NetX Duo due to improper handling of the unmasking cursor during the processing of chained packets. When the WebSocket client processes a masked server frame that is split across two packets, it inadvertently allows the unmasking cursor to loop through unused areas of the first packet. This flaw results in attacker-controlled data corruption via the four-byte WebSocket masking key, making exploitation possible. Proper safeguards must be implemented to prevent this vulnerability from being abused in real-world scenarios.

References