CVE-2026-94018High· 8.8▾ TwilightThe Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a `Content-Length` underflow while processing a `PUT` request. The condition is reachable by an unauthenticated remote client with a single m…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a Content-Length underflow while processing a PUT request. The condition is reachable by an unauthenticated remote client with a single malformed request.
netx_duo >= 6.4.2 <= 6.5.1.202602Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-102717High· 7.5MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash
CVE-2026-93475Critical· 9.3Out-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509
CVE-2026-92853High· 8.7Out-of-bounds Read via a Zero-length TLS 1.3 Certificate Message in NetX Secure
CVE-2026-92843High· 8.7Out-of-bounds Read via the TLS 1.3 Certificate extensions_length in NetX Secure
CVE-2026-93003Medium· 6.9NetX Duo Web HTTP server interprets request body content as HTTP header fields
CVE-2026-92449Medium· 6.8Binary resource loader: unbounded map_id from a theme file causes a heap out-of-bounds write in the GUIX-allocated arena