CVE-2026-102728
UnknownSummary
Two client-side TLS/DTLS handshake parsers in NetX Secure read fields from a server-supplied message before validating that the message is long enough to contain them. Both are bounded out-of-bounds reads on a remotely reachable path, both are reached from a TLS or DTLS client connecting to a malicious or malformed server, and both have the same shape: the bounds check exists and returns the correct status, but it runs after the read it is meant to guard.
Risk Assessment
A remote attacker could exploit the vulnerability to cause out-of-bounds reads, potentially leading to information disclosure or application crash. This affects TLS/DTLS clients using NetX Secure.
Recommendation
Update NetX Secure to a version containing the fix. Until then, avoid connecting to untrusted TLS/DTLS servers.
Other vulnerabilities in NetX Secure
See all- CVE-2026-102760High
When NetX Secure is built with `NX_SECURE_KEY_CLEAR`, every TLS record sent on an active session is wiped after it has been handed to TCP. By then the TCP layer owns the packet chain and may already have released it to the packet pool. The wipe therefore writes zeros into packets that are free or in use by another thread, and when a reused packet's pointers no longer describe the old data, the length of the wipe underflows and it runs past the end of the packet pool.
- CVE-2026-102758Unknown
In the `_nx_secure_x509_asn1_tlv_block_parse()` function in NetX Secure, there is an out-of-bounds read. The function reads the ASN.1 tag byte before checking that the buffer holds at least one byte, causing a one-byte over-read when the remaining length is zero. This affects parsing of X.509 certificates supplied by a remote peer during the TLS handshake.
- CVE-2026-102719Medium
A vulnerability related to a predictable DTLS HelloVerifyRequest cookie in NetX Secure. The predictability of the cookie may allow an attacker to bypass the source address spoofing protection mechanism.
Original NVD description (English source)
Two client-side TLS/DTLS handshake parsers in NetX Secure read fields from a server-supplied message before validating that the message is long enough to contain them. Both are bounded out-of-bounds reads on a remotely reachable path, both are reached from a TLS or DTLS client connecting to a malicious or malformed server, and both have the same shape: the bounds check exists and returns the correct status, but it runs after the read it is meant to guard.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS