CVE-2025-55085

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-55085

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-55085.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-55085

Aliases

GHSA-9c77-rgp9-c2g2

Published

2025-10-17T14:22:28.880Z

Modified

2026-07-15T01:49:04.719570166Z

Severity

8.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Web http client: Unchecked Server-Side Malicious Packet Issue

Details

In NextX Duo before 6.4.4, in the HTTP client module, the network support code for Eclipse Foundation ThreadX, the parsing of HTTP header fields was missing bounds verification. A crafted server response could cause undefined behavior.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55085.json",
    "cna_assigner": "eclipse",
    "cwe_ids": [
        "CWE-125",
        "CWE-1286"
    ]
}

References

Affected packages

Git / github.com/eclipse-threadx/netxduo

Affected ranges

Type

GIT

Repo

https://github.com/eclipse-threadx/netxduo

Events

Introduced

Fixed

e306027c2f60db4653e120460da523ec561edd1d

Database specific

{
    "cpe": "cpe:2.3:a:eclipse:threadx_netx_duo:*:*:*:*:*:*:*:*",
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "6.4.4"
        },
        {
            "fixed": "6.4.4.202503"
        }
    ]
}

Affected versions

v.*

v.6.4.4.202503_rel

v6.*

v6.0.1_rel

v6.0.2_rel

v6.0_rel

v6.1.10_rel

v6.1.11_rel

v6.1.12_rel

v6.1.2_rel

v6.1.3_rel

v6.1.4_rel

v6.1.5_rel

v6.1.6_rel

v6.1.7_rel

v6.1.8_rel

v6.1.9_rel

v6.1_rel

v6.2.0_rel

v6.2.1_rel

v6.3.0_rel

v6.4.0_rel

v6.4.1_rel

v6.4.2_rel

v6.4.3_rel

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-55085.json"