CVE-2026-106464 Eclipse Foundation CVE debrief

Who should care

Defenders responsible for NetX Duo deployments should assess exposure and prioritize verification and remediation efforts, focusing on upgrading to fixed versions and reviewing TLS handshake configurations. This includes reviewing compensating controls for exposed systems while remediation is scheduled and verified, and tracking exceptions, retesting remediated assets, and closing the item only after evidence is documented.

Why it matters

CVE-2026-106464 is a high-severity vulnerability in NetX Duo that allows for remote code execution during the TLS handshake. Defenders responsible for NetX Duo deployments should assess exposure and prioritize verification and remediation efforts.

• Remote code execution during TLS handshake
• Potential for certificate parsing issues
• Need for verification of vulnerability in affected versions
• Priority for upgrading to fixed version

Technical summary

The _nx_secure_x509_parse_signature_data function in NetX Duo computes the certificate signature's length as tlv_length - 1 without first checking that tlv_length is non-zero. This allows a certificate with an empty ASN.1 BIT STRING signature to parse successfully, resulting in a signature length of 0xFFFFFFFF and a signature pointer one byte past the end of the buffer. The input is remote and unauthenticated, as certificates are parsed from the peer during the TLS handshake. Defenders should prioritize verifying the vulnerability in NetX Duo versions up to 6.5.2.202603 and upgrading to 6.5.2.202603a or later.

Defensive priority

Defenders should prioritize verifying the vulnerability in NetX Duo versions up to 6.5.2.202603 and upgrading to 6.5.2.202603a or later.

Recommended defensive actions

• Verify the vulnerability in NetX Duo versions up to 6.5.2.202603
• Upgrade to 6.5.2.202603a or later
• Review and update TLS handshake configurations
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability in NetX Duo, including its description and affected versions. The vulnerability is caused by the _nx_secure_x509_parse_signature_data function computing the certificate signature's length as tlv_length - 1 without first checking that tlv_length is non-zero. This allows a certificate with an empty ASN.1 BIT STRING signature to parse successfully, resulting in a signature length of 0xFFFFFFFF and a signature pointer one byte past the end of the buffer. Defenders should

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.