NetX Secure DTLS server allocates a session for each new source before the cookie exchange and never reclaims it, so spoofed datagrams exhaust the session pool

Summary

In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server allocates a session from its fixed session pool for the first datagram from any unrecognised address and port, before the cookie exchange, and never releases a session whose handshake stalls. A remote, unauthenticated attacker can exhaust the pool with one spoofed datagram per source and deny DTLS service to legitimate clients until the application resets the sessions.

Remediation

1. Inventory every Eclipse Foundation Eclipse ThreadX deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Referencehttps://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-3p2g-x7hh-3w4c
• Referencehttps://gitlab.eclipse.org/security/cve-assignment/-/work_items/487