Is CVE-2026-115215 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-115215 being exploited in the wild.

How severe is CVE-2026-115215?

Informational severity, published 2 November 2026.

Which products and versions are affected?

Eclipse Threadx Netx Duo 6.0 through 6.5.2.202603a.

How is CVE-2026-115215 attacked?

It is attacked over the network.

Am I affected by CVE-2026-115215?

Check whether you run Eclipse Threadx Netx Duo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115215: Eclipse ThreadX NetX Duo DTLS session pool exhaustion

CVE-2026-115215 · Severity: info · Published 2026-11-02

Eclipse ThreadX NetX Duo is a networking library for embedded real-time systems that includes a DTLS (Datagram TLS) secure communication server. A remote attacker can send spoofed datagrams to exhaust the fixed pool of DTLS sessions, denying legitimate clients the ability to establish secure connections until the system is restarted or sessions are manually reset. The attack requires no credentials, no valid data, and the attacker does not need to receive responses.

Technologies: Eclipse Threadx Netx Duo. Vendors: Eclipse.

Quick answers

Is CVE-2026-115215 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-115215 being exploited in the wild.
How severe is CVE-2026-115215?: Informational severity, published 2 November 2026.
Which products and versions are affected?: Eclipse Threadx Netx Duo 6.0 through 6.5.2.202603a.
Is there a fix for CVE-2026-115215?: Yes: fixed in 6.5.2.202603b. Until then: Applications can bound exposure by periodically resetting sessions with nx_secure_dtls_session_reset() or nx_secure_dtls_session_end() if their handshakes do not complete within an application-defined timeout. Ingress filtering to prevent source-address spoofing reduces upstream exposure. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115215 attacked?: It is attacked over the network.
Am I affected by CVE-2026-115215?: Check whether you run Eclipse Threadx Netx Duo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 6.5.2.202603b

Applications can bound exposure by periodically resetting sessions with nx_secure_dtls_session_reset() or nx_secure_dtls_session_end() if their handshakes do not complete within an application-defined timeout. Ingress filtering to prevent source-address spoofing reduces upstream exposure.

Technical details

The NetX Secure DTLS server allocates a session from a fixed session pool for any non-alert datagram from an unrecognized source before verifying the client via cookie exchange, and never releases sessions when handshakes timeout or stall (CWE-770, CWE-772). A remote unauthenticated attacker can send one spoofed datagram per forged source address/port to hold each session indefinitely, exhausting the pool and causing NX_SECURE_TLS_NO_FREE_DTLS_SESSIONS errors for legitimate peers. The fix in version 6.5.2.202603b implements stateless cookies to verify sources before allocation.

Affected products

Eclipse ThreadX NetX Duo 6.0 through 6.5.2.202603a

Timeline

2026-11-02: disclosed
2026-11-02: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.