CVE-2026-11576: eclipse-threadx NetX Duo HTTP PUT Double-Close DoS

Technical summary

CVE-2026-11576 is a use-of-uninitialized-variable and double-close vulnerability introduced in the CVE-2025-0728 remediation for eclipse-threadx NetX Duo. The patched HTTP server PUT handler centralizes error cleanup into a shared label that unconditionally invokes fx_file_close(). However, multiple error paths—including parameter validation failures and permission checks—branch to this cleanup routine before the file open operation (fx_file_open() or equivalent) has been attempted or completed. This causes fx_file_close() to execute with an invalid or uninitialized file handle, triggering undefined behavior. The vulnerability maps to CWE-415 (double-free), CWE-459 (incomplete cleanup), and CWE-908 (use of uninitialized resource).

Business impact

Organizations deploying eclipse-threadx NetX Duo HTTP servers—common in embedded systems, IoT gateways, and real-time networked devices—face service disruption. An unauthenticated remote attacker can trigger the flaw by sending malformed PUT requests, causing the HTTP server process to crash (denial of service). Depending on memory layout and the underlying file system driver, the uninitialized handle dereference could lead to memory corruption, potentially enabling code execution in scenarios where the NetX Duo library is used in safety-critical or networked industrial control systems.

Affected systems

eclipse-threadx NetX Duo is affected. The vulnerability exists in the patched version that addressed CVE-2025-0728; users who applied that prior security fix are now exposed to this regression. Verify the exact affected version range by consulting eclipse-threadx release notes and security advisories—this typically involves builds released after the CVE-2025-0728 patch but before the fix for CVE-2026-11576 becomes available.

Exploitability

Exploitability is straightforward. The vulnerability requires no authentication, no special user privileges, and no user interaction. An attacker with network access to an affected NetX Duo HTTP server can craft a PUT request that fails validation before file opening—for example, by providing invalid headers, exceeding size limits, or submitting requests that the server rejects on policy grounds. The malformed request triggers the shared cleanup path, dereferencing the uninitialized handle. This is a network-accessible denial-of-service primitive that is reliable and trivial to reproduce.

Remediation

Wait for and deploy the official security patch from eclipse-threadx that corrects the error handling logic in the HTTP PUT handler. The fix must ensure that fx_file_close() is only called if the file handle was successfully initialized and opened. This typically involves either: (1) moving the cleanup call inside conditional blocks that verify successful file open, or (2) initializing the file handle to a known invalid state and checking it before closing. Until a patch is available, consider disabling HTTP PUT functionality if not required, restricting PUT requests at the network perimeter, or isolating the NetX Duo service.

Patch guidance

Monitor eclipse-threadx official channels (GitHub releases, security bulletins, and vendor documentation) for a corrected patch addressing CVE-2026-11576. When available, apply it immediately to any production or development systems running the affected NetX Duo version. Test the patch in a non-production environment first to ensure the corrected cleanup logic does not introduce new regressions. Document the patch version applied for audit and compliance purposes.

Detection guidance

Monitor NetX Duo HTTP server logs for sudden crashes or restarts correlated with PUT requests containing unusual or incomplete headers. Set up alerts for file handle exhaustion or 'double close' errors if the library exposes such diagnostics. Network intrusion detection systems (IDS) may flag patterns of repeated PUT requests with invalid Content-Length, authorization, or URI values—these are common triggers for the pre-open error paths. Verify the version of NetX Duo in use across your deployment; version tracking tools can help identify systems that received the CVE-2025-0728 patch but not yet the CVE-2026-11576 fix.

Why prioritize this

This vulnerability merits urgent attention despite not yet being listed on CISA's Known Exploited Vulnerabilities (KEV) catalog. It affects a widely deployed embedded networking library used in IoT, industrial, and networked device contexts. The attack surface is trivial (unauthenticated network access), the trigger is reliable (a malformed PUT request), and the impact is immediate (service crash with potential for memory corruption). Because it is a regression introduced by a prior security patch, organizations that diligently applied the CVE-2025-0728 fix are now at risk—this creates urgent pressure to deploy a corrective patch quickly.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible denial-of-service vulnerability with no user interaction and no privilege requirement. The attack complexity is low, and the impact is availability—the HTTP server crashes when the uninitialized handle is dereferenced. The score does not rate a probability of code execution; however, in memory-unsafe languages or configurations with insufficient isolation, uninitialized handle dereference can corrupt memory structures, raising real-world risk above the base score.

Frequently asked questions