Vulnerability in TLS 1.3 Certificate-message parser affects NetX Secure by Eclipse

CVE-2026-92843

What is CVE-2026-92843?

A vulnerability exists in the TLS 1.3 Certificate-message parser of NetX Secure that allows a malicious TLS 1.3 server to exploit a missing bounds check. This may trigger an unsigned-integer underflow, resulting in a heap out-of-bounds read in any peer that processes a remote Certificate message. This issue can be exploited pre-authentication during the normal handshake process, before the certificate verification is completed, potentially allowing attackers to manipulate memory and execute arbitrary code.

References