Quick answers
- Is CVE-2026-93003 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-93003 being exploited in the wild.
- How severe is CVE-2026-93003?
- Informational severity, published 20 October 2026.
- Which products and versions are affected?
- Eclipse ThreadX NetX Duo through 6.5.1.202602.
- Is there a fix for CVE-2026-93003?
- Yes: fixed in 6.5.2.202603. Until then: Restrict request methods to those without a message body, or reject requests whose body is not required by the application. Deployments behind a reverse proxy should ensure the proxy normalizes request framing and rejects requests carrying both Content-Length and Transfer-Encoding headers. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-93003 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-93003?
- Check whether you run Eclipse ThreadX NetX Duo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 6.5.2.202603
Restrict request methods to those without a message body, or reject requests whose body is not required by the application. Deployments behind a reverse proxy should ensure the proxy normalizes request framing and rejects requests carrying both Content-Length and Transfer-Encoding headers.
Technical details
The HTTP server's field-value parsing function scans the entire packet from start to end, including the message body, instead of stopping at the CRLFCRLF boundary that marks the end of headers per RFC 7230. An attacker can inject header field names into the request body to trigger request-framing confusion; if Content-Length is declared but the body contains Transfer-Encoding: chunked, the server processes it as chunked while a proxy interprets it by Content-Length, creating a CL.TE request smuggling primitive. The vulnerability affects Transfer-Encoding, Connection, Content-Type, and If-Modified-Since field extraction.
Affected products
- Eclipse ThreadX NetX Duo through 6.5.1.202602
Timeline
- 2026-10-02: disclosed
- 2026-10-02: patched