CVE-2025-2258CWE-191

Eclipse ThreadX NetX Duo HTTP server single PUT request integer underflow

Medium · published April 6, 2025

CVSS v4.0
5.3
EPSS
1%
Percentile
61.3
In the wild
Unconfirmed
What it is

In NetX Duo component HTTP server functionality of Eclipse ThreadX NetX Duo before

version 6.4.3, an attacker can cause an integer underflow and a

subsequent denial of service by writing a very large file, by specially

crafted packets with Content-Length smaller than the data request size. A

possible workaround is to disable HTTP PUT support.

This issue follows an uncomplete fix in CVE-2025-0728.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00961 · 61.3th percentile
Weakness
CWE-191 · Integer Underflow (Wrap or Wraparound)
Published
2025-04-06T18:50Z
EPSS history
Timeline
  • 06 APR 18:50Z
    Eclipse ThreadX NetX Duo HTTP server single PUT request integer underflow
    cvelistv5