CVE-2026-102761 PUBLISHED

Assigner: eclipse
Reserved: 29.09.2026 Published: 29.09.2026 Updated: 29.09.2026

NetX Duo's WebSocket client resets the unmasking cursor to the first NX_PACKET each time it advances through a chained packet, while the loop's upper bound belongs to the current packet. With the standard contiguous packet-pool layout, a masked server frame split across two packets therefore drives the XOR loop through the first packet's unused payload area and on through the second packet's NX_PACKET control block.

The four-byte WebSocket masking key controls the bytes written, so the corruption is attacker-chosen rather than incidental.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 9.3

Product Status

Vendor Eclipse Foundation
Product NetX Duo
Versions Default: unaffected
  • affected from 6.2.0 to 6.5.1.202602 (incl.)
  • Version 6.5.2.202603 is unaffected

Credits

  • leginwos reporter
  • adawn0106 reporter

References

Problem Types

  • CWE-787 Out-of-bounds Write CWE