DTLS Server Vulnerability in NetX Secure from Eclipse

CVE-2026-106465

What is CVE-2026-106465?

The NetX Secure DTLS server has a notable security weakness due to its failure to properly verify cookies returned by clients during the handshake process. When the server sends a HelloVerifyRequest with a newly generated cookie, it neglects to check the validity of the cookie that the client sends back. As a result, it relies solely on the length of the client’s cookie to determine if the client is verified. This flaw allows a malicious peer to craft a ClientHello message that incorporates any byte from the cookie, effectively skipping the verification process. Consequently, the server may incorrectly establish handshakes, enabling attackers to exploit this vulnerability to use forged source addresses with no return-routability check in place.

References