{"affected":[{"defaultStatus":"unaffected","product":"Eclipse ThreadX NetX Duo","source":"CNA: eclipse","vendor":"Eclipse Foundation","versions":[{"lessThanOrEqual":"6.5.2.202603","status":"affected","version":"6.0","versionType":"custom"},{"status":"unaffected","version":"6.5.2.202603a","versionType":"custom"}]}],"cveId":"CVE-2026-106465","cwes":["CWE-290","CWE-406"],"description":"In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603, the NetX Secure DTLS server never compares the cookie a client returns with the one it issued, and treats any non-empty cookie as verified. A remote attacker can make the server send its full handshake flight, several kilobytes, to a forged source address, using it to reflect amplified traffic at a third party.","epss":{"date":"2026-11-03","percentile":0.23554,"score":0.00307},"exploits":[],"kev":null,"metrics":[{"score":6.9,"severity":"medium","source":"CNA: eclipse","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L","version":"4.0"}],"modifiedAt":1793798635487,"publishedAt":1792000031013,"references":[{"source":"CNA: eclipse","tags":[],"url":"https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-7c5f-gmpm-f655"},{"source":"CNA: eclipse","tags":[],"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/379"}],"remediation":[],"revision":"f6a3add3749323b9bf80d84887d674cdc1bb439ed51f95cc8bad005539e5a2e2","sources":[{"modifiedAt":1793798635487,"name":"CNA: eclipse","retrievedAt":1793801328064,"url":"https://www.cve.org/CVERecord?id=CVE-2026-106465"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793801400154,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106465"}],"ssvc":{"assessedAt":1792181674554,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Missing HelloVerifyRequest cookie validation in the NetX Secure DTLS server","updatedAt":1793801400154}