CVE-2026-11576

7.5 Élevée

Publiée le 19/06/2026 à 12:16 · Modifiée le 02/07/2026 à 22:04 · Analysée par le NVD · Source : emo@eclipse.org

Description

The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this unified cleanup path unconditionally calls fx_file_close() even when the file was never successfully opened. Multiple error branches jump to the shared cleanup label before any file open operation has occurred, causing fx_file_close() to operate on an uninitialized file handle, leading to undefined behavior, double-close issues, or memory corruption.

Traduire en français

Produits concernés

Eclipse Foundation Eclipse ThreadX - NetX Duo
Eclipse threadx netx duo

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.5 Élevée	emo@eclipse.org	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

Faiblesses (CWE)

CWE-415
CWE-459
CWE-908

Références

https://gitlab.eclipse.org/security/cve-assignment/-/work_items/123 Broken Link

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories