GHSA-f42f-6fvv-xqx3: Eclipse ThreadX NetX Duo HTTP Component server denial of service

GHSA ID

GHSA‑f42f‑6fvv‑xqx3

CVE ID

CVE‑2025‑2260

Severity

Medium

CVSS score

6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Published

2025‑04‑06

Last updated

2025‑04‑06

Affected packages

Package Vulnerable versions Patched versions

NetX Duo

⇐ 6.4.2

6.4.3

Description

Summary

A denial of service vulnerability exists in the NetX HTTP component server functionality of Eclipse ThreadX NetX Duo git commit https://github.com/eclipse-threadx/netxduo/commit/6c8e9d1c95d71bd4b313e1cc37d8f8841543b248. A specially crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.

Details

Summary

A denial of service vulnerability exists in the NetX HTTP server functionality of Eclipse ThreadX NetX Duo git commit 6c8e9d1. A specially crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.

Confirmed Vulnerable Versions

The versions below were either tested or verified to be vulnerable by Talos or confirmed to be vulnerable by the vendor.

Eclipse ThreadX NetX Duo git commit 6c8e9d1

Product URLs

Eclipse ThreadX NetX Duo - https://github.com/eclipse-threadx/netxduo

Details

Eclipse ThreadX NetX Duo is an industrial-grade TCP/IP network stack tailored specifically for deeply embedded real-time and IoT applications. Eclipse ThreadX NetX Duo offers a dual network stack supporting both IPv4 and IPv6

While processing an HTTP PUT request, the HTTP server will create the requested file and open it for writing. If an error occurs after the file is opened, the file is not properly closed. After that, any subsequent HTTP requests involving a file resource will result in the server responding with a 404 file not found error. This vulnerability affects both HTTP server implementations within NetX Duo.

This is the same issue as reported in https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-pwf8-5q9w-m763

The fix in https://github.com/eclipse-threadx/netxduo/commit/c78d650be7377aae1a8704bc0ce5cc6f9f189014 was incomplete and did not include the Component HTTP server. The complete fix is in https://github.com/eclipse-threadx/netxduo/commit/fb3195bbb6d0d6fe71a7a19585c008623c217f9e

NetX Duo Component HTTP server

This vulnerability affects the NetX Duo Component HTTP Server implementation which can be found in netxduo\addons\http\nxd_http_server.c

Mitigation

Developers can disable the processing of PUT requests by ending the processing of a PUT request in an application callback request notify function.

Credit

Discovered by Kelly Patterson of Cisco Talos.