{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-102714 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-102714 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-102714 is a high-severity denial of service vulnerability in Eclipse Foundation NetX Duo, published on 29 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-102714 and fix it if it is affected.\n\nWhat it is: CVE-2026-102714 is a high-severity denial of service vulnerability in Eclipse Foundation NetX Duo, published on 29 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-102714 in the wild and no public exploit code.\n\nAffected product: Eclipse Foundation NetX Duo. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-102714/ (Markdown: https://insights.sbomify.com/CVE-2026-102714/index.md)","id":"CVE-2026-102714","markdown":"https://insights.sbomify.com/CVE-2026-102714/index.md","name":"CVE-2026-102714","record":{"aliases":["GHSA-39p4-p83c-58hr","GHSA-jj75-gvv3-wr54"],"analysis":{"component_type":"operating_system","fix_type":"patch","impacts":["denial_of_service","data_read"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"NetX Duo TCP/IP stack","requires_auth":"none","summary":"Attackers can cause infinite loops or out-of-bounds reads in NetX Duo by sending malformed ICMPv6 packets, leading to system hangs or memory exposure.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"eclipse","cpe":[],"cvss":{"score":7.1,"severity":"high","source":"cna","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-835","name":"Loop with Unreachable Exit Condition"},{"id":"CWE-191","name":"Integer Underflow (Wrap or Wraparound)"},{"id":"CWE-1287","name":"Improper Validation of Specified Type of Input"},{"id":"CWE-125","name":"Out-of-bounds Read"}],"description":"`_nx_icmpv6_validate_options()` scans the option area with `while (length \u003e 2)` (`common/src/nx_icmpv6_validate_options.c:79`). An area whose size leaves a one- or two-byte residue exits the loop with that tail unexamined; the residue is not negative, so the function returns `NX_SUCCESS`. Its zero-length rejection never sees those bytes.\n\nEvery consumer then re-walks the same area, reading a two-byte option header at the residue and subtracting `nx_icmpv6_option_length \u003c\u003c 3` with no zero check and no remaining-length check. Three outcomes follow, selected by bytes the attacker controls.\n\n**Zero length byte.** The walker subtracts zero and advances zero. All four handlers loop forever — `_nx_icmpv6_process_ra` (`nx_icmpv6_process_ra.c:245, :528`), `_nx_icmpv6_process_ns` (`:251, :329`), `_nx_icmpv6_process_na` (`:147, :156`) and `_nx_icmpv6_process_redirect` (`:247, :350`). The walk runs in the IP thread, which is the highest-priority thread and does not yield inside the loop, so the system stops until a watchdog reset and the frame can be replayed after each one.\n\n**Non-zero length byte on a short residue.** The three unsigned counters underflow — `2 - 8` becomes `0xFFFFFFFA` — and the walk continues past the packet buffer, reading until it faults or meets a zero length byte and freezes. The Router Advertisement counter is signed and exits cleanly in this case.\n\n**One-byte residue.** The walker reads a two-byte option header, over-reading one byte.\n\nDuring a runaway walk, stray bytes parsing as a link-layer address option are copied into the neighbor cache (`nx_icmpv6_process_ns.c:280, :293`) and subsequently used as the destination MAC for frames to that neighbour, placing off-packet memory on the link. Confirmed by inspection, not reproduced.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"Denial of service in NetX Duo","id":"CVE-2026-102714","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":0,"n_references":1,"next":{"headline":"Memory corruption in eclipse-threadx/netxduo","id":"CVE-2026-102715"},"packages":[],"prev":{"headline":"Memory corruption in NetX Duo","id":"CVE-2026-102713"},"products":["NetX Duo"],"published":"2026-09-29","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-09-29","vendors":["Eclipse Foundation"]},"summary":"Attackers can cause infinite loops or out-of-bounds reads in NetX Duo by sending malformed ICMPv6 packets, leading to system hangs or memory exposure.","url":"https://insights.sbomify.com/CVE-2026-102714/"}