CVE-2026-102760

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-102760

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102760.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-102760

Aliases

GHSA-8w5x-ff58-2fr2

Published

2026-09-29T17:29:11Z

Modified

2026-10-01T03:30:38Z

Severity

8.3 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

[none]

Details

When NetX Secure is built with NX_SECURE_KEY_CLEAR, every TLS record sent on an active session is wiped after it has been handed to TCP. By then the TCP layer owns the packet chain and may already have released it to the packet pool. The wipe therefore writes zeros into packets that are free or in use by another thread, and when a reused packet's pointers no longer describe the old data, the length of the wipe underflows and it runs past the end of the packet pool.

Database specific

{
    "cna_assigner":  "eclipse",
    "cwe_ids":  [
        "CWE-416"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102760.json"
}

References

Affected packages

Git / github.com/eclipse-threadx/netxduo

Affected ranges

Type

GIT

Repo

https://github.com/eclipse-threadx/netxduo

Events

Introduced

009da2f05a9fc098b8d699b2b814e515631d41cb

Last Affected

1a0e9e43a03e37ddecfb6b49e9b078d6e1803d05

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "6.0"
        },
        {
            "last_affected":  "6.5.1.202602"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v.*

v.6.4.4.202503_rel

v6.*

v6.0.1_rel

v6.0.2_rel

v6.0_rel

v6.1.10_rel

v6.1.11_rel

v6.1.12_rel

v6.1.2_rel

v6.1.3_rel

v6.1.4_rel

v6.1.5_rel

v6.1.6_rel

v6.1.7_rel

v6.1.8_rel

v6.1.9_rel

v6.1_rel

v6.2.0_rel

v6.2.1_rel

v6.3.0_rel

v6.4.0_rel

v6.4.1_rel

v6.4.2_rel

v6.4.3_rel

v6.4.4.202503a

v6.4.5.202504_rel

v6.5.0.202601_rel

v6.5.1.202602_rel

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102760.json"