Block Malformed PUT Requests to Prevent NetX Duo Remote Crash
An unauthenticated remote crash flaw in Eclipse ThreadX NetX Duo allows attackers to crash servers via a single bad HTTP request.
Key points
- CVE-2026-94018 carries a CVSS score of 8.8, rated as high severity.
- The vulnerability affects Eclipse ThreadX NetX Duo versions up to 6.5.1.202602.
- Attackers can trigger the crash using a single malformed PUT request with content-length underflow.
Eclipse ThreadX NetX Duo contains a high-severity remote crash vulnerability that allows unauthenticated attackers to disrupt services. The flaw exists in the web add-on's HTTP server component. Security researchers identified that the server mishandles specific input conditions during request processing. This issue affects software versions up to 6.5.1.202602.
The risk
The vulnerability, tracked as CVE-2026-94018, stems from improper pointer handling within the HTTP server. According to the National Vulnerability Database, the server dereferences and releases an uninitialized pointer. This occurs when the system detects a Content-Length underflow while processing a PUT request. The weakness is classified under CWE-457 and CWE-824.
Who is exposed
Any environment running Eclipse ThreadX NetX Duo up to version 6.5.1.202602 is potentially exposed to this risk. The condition is reachable by an unauthenticated remote client. Attackers do not need credentials to exploit the flaw. A single malformed request is sufficient to trigger the crash condition.
Cost and compliance
The source material does not provide specific details regarding financial costs or regulatory compliance impacts associated with CVE-2026-94018. No information was provided about affected industries or specific compliance frameworks. The National Vulnerability Database record focuses solely on technical severity and affected versions.
Our take on the response
Teams should immediately verify if their embedded systems use vulnerable NetX Duo versions. Network-level filtering of malformed PUT requests may reduce exposure. Monitor for unexpected service restarts on affected devices.
What defenders should look for
Security operations teams should monitor web server logs for unusual PUT request patterns, particularly those with missing or negative content lengths. Look for sudden service terminations or crashes following these specific requests. Check for unauthenticated access attempts targeting HTTP endpoints. Implement temporary blocking rules for malformed headers at the firewall level. Investigate any unexpected process restarts on embedded devices running vulnerable software versions.
What to do and how to stay safe: Eclipse ThreadX
- Audit your inventory to identify any systems running Eclipse ThreadX NetX Duo up to version 6.5.1.202602.
- Configure network firewalls to drop malformed PUT requests with invalid or underflowing Content-Length headers.
- Monitor application logs for unauthenticated access attempts followed by immediate service crashes or restarts.
- Contact the vendor directly to inquire about the status of a patch or workaround for CVE-2026-94018.
Step-by-step guide: Unpatched Software Response: Containment, Recovery, and Prevention Steps
General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-94018?
The CVSS score is 8.8, which is rated as high severity.
Which versions of NetX Duo are affected?
Versions up to 6.5.1.202602 are affected by this vulnerability.
Is authentication required to exploit this flaw?
No, an unauthenticated remote client can exploit the vulnerability with a single request.
