CVE-2026-102762

The NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH message. Each malformed PUBLISH costs one packet, or one chain of packets, from the network driver's receive pool, and nothing returns it. A peer that can deliver a few dozen such messages exhausts the pool and stops all inbound network traffic on the device until it is rebooted.

• CWE-401

• https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-9v23-qwp9-2q3h

Published

Sep 29, 2026

Last Modified

Sep 29, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-102757An unprivileged, memory-protected ThreadX module can have th…8.5
• CVE-2026-102758The `_nx_secure_x509_asn1_tlv_block_parse()` function parses…
• CVE-2026-102759NetX Secure TLS accepts an empty application-data record wit…6.3
• CVE-2026-10276A vulnerability has been found in hekmon8 Jenkins-server-mcp…6.3
• CVE-2026-102760When NetX Secure is built with `NX_SECURE_KEY_CLEAR`, every …8.3
• CVE-2026-102761NetX Duo's WebSocket client resets the unmasking cursor to t…9.3
• CVE-2026-10277A vulnerability was found in j3k0 mcp-google-workspace up to…6.3
• CVE-2026-10278A vulnerability was determined in ishayoyo excel-mcp up to 1…6.3
• CVE-2026-10279A vulnerability was identified in hiraishikentaro wezterm-mc…6.3
• CVE-2026-102796Improper Neutralization of Special Elements used in an SQL C…
• CVE-2026-10280A security flaw has been discovered in horizon921 mcpilot 0.…7.3
• CVE-2026-102806OpenClaw before 2026.9.5 contains an incorrect authorization…6.3