# CVE-2026-103416: Eclipse ThreadX NetX Duo out-of-bounds write in TLS 1.3 handshake cache

Source: https://junglewise.ai/threats/cve-2026-103416-out-of-bounds-write-via-the-tls-1-3-handshake-message-cache-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-07. Updated: 2026-10-07  
License: CC BY 4.0 with a link back

CVE-2026-103416 · Severity: info · Published 2026-10-07

NetX Duo is a network stack library used in embedded systems and IoT devices for TLS/SSL communication. An out-of-bounds write vulnerability in the TLS 1.3 handshake message caching allows a malicious server to overwrite critical data structures before certificate authentication completes, potentially causing crashes or enabling further exploitation.

Technologies: [Eclipse ThreadX NetX Duo](https://junglewise.ai/threats/technologies/eclipse-threadx-netx-duo). Vendors: [Eclipse ThreadX](https://junglewise.ai/threats/vendors/eclipse-threadx).

## Quick answers

**Is CVE-2026-103416 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-103416 being exploited in the wild.

**How severe is CVE-2026-103416?** Informational severity, published 7 October 2026.

**Which products and versions are affected?** Eclipse ThreadX NetX Duo <= 6.5.1.202602.

**Is there a fix for CVE-2026-103416?** Yes: fixed in NetX Duo 6.5.2.202603. Until then: Builds without TLS 1.3 enabled (NX_SECURE_TLS_ENABLE_TLS_1_3 disabled) avoid the HelloRetryRequest path; however, there is no workaround for deployments that require TLS 1.3 client support. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-103416 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-103416?** Check whether you run Eclipse ThreadX NetX Duo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in NetX Duo 6.5.2.202603

Builds without TLS 1.3 enabled (NX_SECURE_TLS_ENABLE_TLS_1_3 disabled) avoid the HelloRetryRequest path; however, there is no workaround for deployments that require TLS 1.3 client support.

## Technical details

The _nx_secure_tls_send_handshake_record function caches outgoing TLS 1.3 handshake messages in a fixed 500-byte array without bounds checking. A malicious or compromised server can send a HelloRetryRequest with an oversized cookie that causes the client to generate a ClientHello larger than the cache, writing past the array into adjacent session control block memory containing pointers. This occurs before server certificate validation, requiring only network connectivity to the attacker's endpoint.

## Affected products

- Eclipse ThreadX NetX Duo <= 6.5.1.202602

## Timeline

- 2026-10-02: disclosed
- 2026-10-07: advisory

## References

- [https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-4x76-j955-qhq2](https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-4x76-j955-qhq2)
- [https://gitlab.eclipse.org/security/cve-assignment/-/work_items/356](https://gitlab.eclipse.org/security/cve-assignment/-/work_items/356)

## Related threats

- [Eclipse ThreadX NetX Duo NULL pointer dereference in ICMPv6 path MTU discovery](https://junglewise.ai/threats/cve-2026-114408-in-eclipse-threadx-netx-duo-versions-6-4-5-202504-through-6-5-2)
- [Eclipse ThreadX NetX Duo Web HTTP server use-after-free](https://junglewise.ai/threats/cve-2026-94018-the-web-add-on-s-http-server-dereferences-and-releases-an)
- [Eclipse ThreadX NetX Duo HTTP server request framing confusion](https://junglewise.ai/threats/cve-2026-93003-the-web-add-on-s-http-server-searches-the-entire-request-packet)
- [NetX Secure TLS 1.3 out-of-bounds read in Certificate parser](https://junglewise.ai/threats/cve-2026-92853-the-tls-1-3-certificate-message-parser-in-netx-secure-decrements)
- [NetX Secure DTLS server missing HelloVerifyRequest cookie validation](https://junglewise.ai/threats/cve-2026-106465-the-netx-secure-dtls-server-sends-a-helloverifyrequest-carrying)