# CVE-2026-102714: Denial of service in NetX Duo

> Attackers can cause infinite loops or out-of-bounds reads in NetX Duo by sending malformed ICMPv6 packets, leading to system hangs or memory exposure.

- **Severity:** High 7.1 (`CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** No
- **Published:** 29 Sep 2026
- **Updated:** 29 Sep 2026
- **Also known as:** GHSA-39p4-p83c-58hr, GHSA-jj75-gvv3-wr54

## What is CVE-2026-102714?

CVE-2026-102714 is a high-severity denial of service vulnerability in Eclipse Foundation NetX Duo, published on 29 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

`_nx_icmpv6_validate_options()` scans the option area with `while (length > 2)` (`common/src/nx_icmpv6_validate_options.c:79`). An area whose size leaves a one- or two-byte residue exits the loop with that tail unexamined; the residue is not negative, so the function returns `NX_SUCCESS`. Its zero-length rejection never sees those bytes.

Every consumer then re-walks the same area, reading a two-byte option header at the residue and subtracting `nx_icmpv6_option_length << 3` with no zero check and no remaining-length check. Three outcomes follow, selected by bytes the attacker controls.

**Zero length byte.** The walker subtracts zero and advances zero. All four handlers loop forever — `_nx_icmpv6_process_ra` (`nx_icmpv6_process_ra.c:245, :528`), `_nx_icmpv6_process_ns` (`:251, :329`), `_nx_icmpv6_process_na` (`:147, :156`) and `_nx_icmpv6_process_redirect` (`:247, :350`). The walk runs in the IP thread, which is the highest-priority thread and does not yield inside the loop, so the system stops until a watchdog reset and the frame can be replayed after each one.

**Non-zero length byte on a short residue.** The three unsigned counters underflow — `2 - 8` becomes `0xFFFFFFFA` — and the walk continues past the packet buffer, reading until it faults or meets a zero length byte and freezes. The Router Advertisement counter is signed and exits cleanly in this case.

**One-byte residue.** The walker reads a two-byte option header, over-reading one byte.

During a runaway walk, stray bytes parsing as a link-layer address option are copied into the neighbor cache (`nx_icmpv6_process_ns.c:280, :293`) and subsequently used as the destination MAC for frames to that neighbour, placing off-packet memory on the link. Confirmed by inspection, not reproduced.

Weakness: CWE-835 (Loop with Unreachable Exit Condition), CWE-191 (Integer Underflow (Wrap or Wraparound)), CWE-1287 (Improper Validation of Specified Type of Input), CWE-125 (Out-of-bounds Read)

## Which versions are affected by CVE-2026-102714?


## How do I fix CVE-2026-102714?

No fix has been published for CVE-2026-102714 yet. Limit exposure of the affected software until one is available.

## Is CVE-2026-102714 being exploited?

There is no known exploitation of CVE-2026-102714 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-102714 and fix it if it is affected.

What it is: CVE-2026-102714 is a high-severity denial of service vulnerability in Eclipse Foundation NetX Duo, published on 29 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-102714 in the wild and no public exploit code.

Affected product: Eclipse Foundation NetX Duo. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-102714/ (Markdown: https://insights.sbomify.com/CVE-2026-102714/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-102714
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102714
- OSV: https://osv.dev/vulnerability/CVE-2026-102714

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-102714/
Summaries are generated and may contain mistakes; the official description above is the record.