Remote Denial of Service in Eclipse ThreadX NetX Duo DTLS Server

CVE-2026-115215

What is CVE-2026-115215?

In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the DTLS server improperly handles session allocation. When it receives its first datagram from an unrecognized address and port, it allocates a session from its fixed session pool prior to completing the cookie exchange. If the handshake process stalls, this session is never released, allowing an unauthenticated remote attacker to exploit this flaw. By sending a single spoofed datagram from various source addresses, the attacker can exhaust the DTLS session pool. This effectively denies legitimate clients access to DTLS service until the application resets the active sessions.

References