Skip to content
OpenAdvisories
High · 7.1 CVE-2026-102715 EUVD-2026-89178GHSA-rp9p-ggxc-p9xm

mDNS string cache accepts a shorter name as a match for a longer stored one, so the known-answer encoder writes past the transmit packet

Published Sep 29, 2026 · Updated Nov 10, 2026 · Assigned by eclipse

Description

In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the mDNS add-on's string cache accepts a shorter name as a match for a longer stored one. A host on the local link can send two mDNS records that make a device performing continuous service discovery write up to three bytes past its transmit packet, corrupting a neighbouring packet or the pool's free list, and misattribute discovered records.

Affected products

VendorProductAffectedFixed
Eclipse Foundation Eclipse ThreadX NetX Duo ≤ 6.5.2.202603 6.5.2.202603a

References