Quick answers
- Is CVE-2026-103415 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-103415 being exploited in the wild.
- How severe is CVE-2026-103415?
- Informational severity, published 14 October 2026.
- Which products and versions are affected?
- Eclipse ThreadX NetX Duo <= 6.5.1.202602.
- Is there a fix for CVE-2026-103415?
- Yes: fixed in 6.5.2.202603. Until then: Disable TLS 1.3 if it is not required, as the vulnerability requires NX_SECURE_TLS_ENABLE_TLS_1_3 to be explicitly enabled (it defaults to off). Restrict client connections to trusted TLS endpoints only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-103415 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-103415?
- Check whether you run Eclipse ThreadX NetX Duo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 6.5.2.202603
Disable TLS 1.3 if it is not required, as the vulnerability requires NX_SECURE_TLS_ENABLE_TLS_1_3 to be explicitly enabled (it defaults to off). Restrict client connections to trusted TLS endpoints only.
Technical details
The vulnerability is an out-of-bounds write in the TLS 1.3 client-side HelloRetryRequest cookie handling. When processing a server's cookie extension, the code copies both the cookie length (a 16-bit peer-controlled value) and its contents into the ClientHello buffer without validating that space is available, and this write occurs before certificate validation. An attacker can control the cookie length and contents to overwrite memory, potentially achieving code execution.
Affected products
- Eclipse ThreadX NetX Duo <= 6.5.1.202602
Timeline
- 2026-10-02: disclosed
- 2026-10-03: patched