CVE-2026-106465 Eclipse Foundation CVE debrief

Who should care

NetX Duo users and administrators should assess exposure, verify versions, and implement proper mitigations to prevent potential forged source address attacks. Affected users must review and update their DTLS handshake verification processes to ensure secure communication. Security teams should prioritize verification and remediation efforts for this high-impact vulnerability.

Why it matters

CVE-2026-106465 allows forged source addresses to bypass return-routability checks in NetX Secure DTLS server. Users should verify versions and implement proper cookie verification.

• Potential for forged source address attacks
• Bypass of return-routability check
• Incomplete DTLS handshake verification

Technical summary

The NetX Secure DTLS server sends a HelloVerifyRequest carrying a freshly generated cookie but never checks the cookie a client returns. A peer that puts any single cookie byte in its first ClientHello skips the verification exchange entirely, allowing forged source addresses to bypass return-routability checks. The server then decides whether the client has been verified from the cookie's length alone, leading to incomplete DTLS handshake verification. Users should verify affected versions and implement proper cookie verification to prevent potential attacks.

Defensive priority

High priority for NetX Duo users to verify and remediate

Recommended defensive actions

• Verify NetX Duo version and check for updates
• Implement proper cookie verification for DTLS handshakes
• Monitor for potential forged source address attacks
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

Official CVE Program record and NVD vulnerability detail page provide information on the vulnerability. NetX Duo versions up to 6.5.2.202603 are affected. Evidence is limited to public CVE and NVD details. Defenders should verify affected versions and implement proper cookie verification for DTLS handshakes. Additional verification and review are necessary to confirm exposure and apply mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.