{"affected":[{"defaultStatus":"unaffected","product":"Eclipse ThreadX","source":"CNA: eclipse","vendor":"Eclipse Foundation","versions":[{"lessThanOrEqual":"6.5.2.202603a","status":"affected","version":"6.0","versionType":"custom"}]}],"cveId":"CVE-2026-115215","cwes":["CWE-770","CWE-772"],"description":"In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server allocates a session from its fixed session pool for the first datagram from any unrecognised address and port, before the cookie exchange, and never releases a session whose handshake stalls. A remote, unauthenticated attacker can exhaust the pool with one spoofed datagram per source and deny DTLS service to legitimate clients until the application resets the sessions.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.7,"severity":"high","source":"CNA: eclipse","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1793655833639,"publishedAt":1793655833639,"references":[{"source":"CNA: eclipse","tags":[],"url":"https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-3p2g-x7hh-3w4c"},{"source":"CNA: eclipse","tags":[],"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/487"}],"remediation":[],"revision":"35c1d21a504e0f61eb266cdc9b6a0d349573f46a89a966846c7e4c907a3fd644","sources":[{"modifiedAt":1793655833639,"name":"CNA: eclipse","retrievedAt":1793657314346,"url":"https://www.cve.org/CVERecord?id=CVE-2026-115215"}],"ssvc":null,"status":"published","title":"NetX Secure DTLS server allocates a session for each new source before the cookie exchange and never reclaims it, so spoofed datagrams exhaust the session pool","updatedAt":1793657314346}