CVE-2025-2260

In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.3, an attacker can cause a denial of service by specially crafted packets. The core issue is missing closing of a file in case of an error condition, resulting in the 404 error for each further file request. Users can work-around the issue by disabling the PUT request support. This issue follows an incomplete fix of CVE-2025-0726.

In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.3, an attacker can cause a denial of service by specially crafted packets. The core issue is missing closing of a file in case of an error condition, resulting in the 404 error for each further file request. Users can work-around the issue by disabling the PUT request support. This issue follows an incomplete fix of CVE-2025-0726.

En la funcionalidad del servidor HTTP NetX de Eclipse ThreadX NetX Duo anterior a la versión 6.4.3, un atacante podía provocar una denegación de servicio mediante paquetes especialmente manipulados. El problema principal radica en que no se cierra un archivo en caso de error, lo que genera un error 404 con cada solicitud de archivo posterior. Los usuarios pueden solucionar el problema deshabilitando la compatibilidad con solicitudes PUT. Este problema surge tras una corrección incompleta de CVE-2025-0726.