---
id: CVE-2026-102760
title: >-
  When NetX Secure is built with `NX_SECURE_KEY_CLEAR`, every TLS record sent on
  an active session is wiped after it has been handed to TCP
summary: >-
  When NetX Secure is built with `NX_SECURE_KEY_CLEAR`, every TLS record sent on
  an active session is wiped after it has been handed to TCP. By then the TCP
  layer owns the packet chain and may already have released it to the packet
  pool. T…
severity: high
cvss: 8.3
cvssVector: 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N'
cwe:
  - CWE-416
vendor: Eclipse Foundation
product: NetX Duo
affected:
  - netx_duo >= 6.0 <= 6.5.1.202602
published: '2026-09-29'
updated: '2026-09-29'
sourceUpdated: '2026-09-29T18:17:13.313'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-102760'
references:
  - url: >-
      https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-8w5x-ff58-2fr2
    label: emo@eclipse.org
tags:
  - nvd
  - cve.org
cvssSource: cna
ingestedAt: '2026-09-29T17:41:02.255Z'
---

## Overview

When NetX Secure is built with `NX_SECURE_KEY_CLEAR`, every TLS record sent on an active session is wiped after it has been handed to TCP. By then the TCP layer owns the packet chain and may already have released it to the packet pool. The wipe therefore writes zeros into packets that are free or in use by another thread, and when a reused packet's pointers no longer describe the old data, the length of the wipe underflows and it runs past the end of the packet pool.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.