Pointer Dereference Vulnerability in Eclipse ThreadX Web Add-on
CVE-2026-94018

8.8HIGH

Key Information:

Vendor: Eclipse Foundation
Status: Eclipse Threadx - Netx Duo
Vendor: CVE Published:; 20 October 2026

🔔 Create Eclipse Foundation Vulnerability Alert

What is CVE-2026-94018?

The Eclipse ThreadX Web add-on contains a vulnerability where the HTTP server dereferences and releases an uninitialized pointer. This can occur when the server processes a malformed PUT request that triggers a Content-Length underflow. An unauthenticated remote client can exploit this issue by sending a single specially crafted request, potentially leading to destabilization of the server environment.

Affected Version(s)

Eclipse ThreadX - NetX Duo 6.4.2 <= 6.5.1.202602

Eclipse ThreadX - NetX Duo 6.5.2.202603

References

https://github.com/eclipse-threadx/netxduo/security/advis...

CVSS V4

Score:

8.8

Severity:

HIGH

Confidentiality:

None

Integrity:

Low

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

None

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 20, 2026
Vulnerability Reserved
Sep 23, 2026

Credit

Yves57

CVE-2026-94018 Data

JSON