GHSA-wjxf-gjm5-jh5q: NetX Duo Web HTTP server releases an uninitialized packet pointer on the PUT Content-Length underflow path
GHSA ID |
|
|---|---|
CVE ID |
CVE‑2026‑94018 |
Severity |
High |
CVSS score |
8.2 ( |
CWE |
|
Published |
2026‑10‑02 |
Last updated |
2026‑10‑02 |
Affected packages
| Package | Vulnerable versions | Patched versions |
|---|---|---|
NetX Duo |
>= 6.4.2, ⇐ 6.5.1.202602 |
6.5.2.202603 |
Description
Summary
The Web add-on’s HTTP server dereferences and releases an uninitialized pointer when it detects a Content-Length underflow while processing a PUT request. The condition is reachable by an unauthenticated remote client with a single malformed request.
Details
In _nx_web_http_server_put_process() (addons/web/nx_web_http_server.c), the local NX_PACKET *data_packet_ptr is declared without an initializer and is first assigned much later, by _nx_web_http_server_packet_get() in the loop that receives any remaining request body.
Two error paths ahead of that assignment called nx_packet_release(data_packet_ptr), so the pointer they released held whatever the stack slot happened to contain:
-
the underflow check on the first packet’s content
-
the same check inside the chained-packet loop
Both are taken when (length - consumed_length) > length, i.e. when the body bytes actually delivered exceed the announced Content-Length and the ULONG subtraction wraps.
Impact
The consequence depends on the build configuration and on the stack contents at the time:
-
Default configuration (
NX_DISABLE_ERROR_CHECKINGnot defined).nx_packet_releaseresolves to_nxe_packet_release, whose integrity check dereferences the supplied pointer to readnx_packet_pool_owner, and then dereferences that value to readnx_packet_pool_id. Both are wild reads off an indeterminate pointer. If either address is unmapped the server faults; otherwise the release is rejected and the request fails cleanly. -
NX_DISABLE_ERROR_CHECKINGbuilds.nx_packet_releaseresolves directly to_nx_packet_release, which performs no validation. The wild pointer is treated as a packet and linked into the pool’s free list, corrupting the packet pool. Subsequent allocations can then hand out that pointer.
The pointer is not reliably null. Instrumenting the branch on a Linux simulation build of the regression suite showed data_packet_ptr = 0xf7f161f8 with a nx_packet_pool_owner of 0xf7de2593, i.e. a stale non-null value that was dereferenced twice before the integrity check rejected it.
Availability is the primary impact; integrity of the packet pool is additionally at risk in NX_DISABLE_ERROR_CHECKING builds.
Whether the request reaches this code without credentials depends on whether the embedding application registers an authentication callback for PUT requests. Deployments that expose PUT unauthenticated are affected without any privileges.
Affected configurations
Introduced in commit b977f985ed8abcbdacfe9a74d1c10379a23215b0 ("Detect underflow in put_process length calculations", 2025-02-06), which added the underflow detection together with the erroneous releases. First shipped in v6.4.2_rel and present in every release since, up to and including 6.5.1.202602. The legacy HTTP add-on (addons/http/nxd_http_server.c) is not affected: its equivalent underflow branches contain no release.
Commit b977f98 was the fix for the PUT request integer underflows reported as TALOS-2024-2105 and TALOS-2024-2106 / CVE-2025-0728, published as GHSA-hqp7-4q26-6wqf, GHSA-jf6x-9mgc-p72w, GHSA-chqp-8vf8-cj25 and GHSA-chhp-gmxc-46rq. The underflow detection it added is correct; what this advisory covers is a new defect introduced alongside it.
This is the second such defect traced to that commit. GHSA-wrwf-jf85-4549 covers the unconditional fx_file_close() on the shared cleanup path introduced by the same refactor.
Patches
Fixed in NetX Duo 6.5.2.202603. The two erroneous nx_packet_release() calls are removed. The underflow is still detected and still answered with 400 Bad Request.
Workarounds
Applications that do not serve PUT requests are not exposed. Requiring authentication for PUT limits reachability to authenticated clients. Builds that leave NetX Duo error checking enabled, which is the default, reduce the impact to a potential crash rather than packet pool corruption.
Credits
Reported and fixed by Yves Marx (@Yves57) in eclipse-threadx/netxduo#395. The chunked packet release on the same error paths and the regression test were added by Frédéric Desbiens (@fdesbiens), with AI assistance under human review, in accordance with the Eclipse Foundation’s Generative AI Usage Guidelines.