CVE-2026-11576: Eclipse ThreadX Use-After-Free Flaw

CVE-2026-11576 Overview

CVE-2026-11576 affects Eclipse ThreadX NetX Duo, an embedded TCP/IP networking stack. The vulnerability resides in the HTTP server PUT processing logic, where a previous security fix for CVE-2025-0728 introduced a shared cleanup label. This cleanup path unconditionally calls fx_file_close() on the file handle, even when no successful fx_file_open() has occurred. Network-reachable attackers can trigger error branches that jump to the cleanup label, causing operations on an uninitialized file handle. The flaw maps to [CWE-415: Double Free] and can lead to undefined behavior or memory corruption in embedded targets running NetX Duo.

Critical Impact
Remote attackers can trigger memory corruption or denial of service against embedded devices exposing the NetX Duo HTTP server PUT endpoint, without authentication or user interaction.

Affected Products

Eclipse ThreadX NetX Duo (HTTP server component)
Embedded devices and firmware integrating NetX Duo with the patched CVE-2025-0728 cleanup logic
Downstream products bundling the affected NetX Duo HTTP server module

Discovery Timeline

2026-06-19 - CVE-2026-11576 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-11576

Vulnerability Analysis

The defect emerged from a regression introduced by the fix for CVE-2025-0728. That earlier fix refactored error handling in the HTTP server PUT processing path to consolidate cleanup operations under a single shared label. The intent was to avoid scattered cleanup logic and resource leaks. However, the unified cleanup path always invokes fx_file_close() on the file handle. Several error branches in the PUT processing logic jump directly to this cleanup label before fx_file_open() has executed successfully. As a result, fx_file_close() operates on a file structure that was never initialized or was already closed in a different error path. The outcome falls under [CWE-415: Double Free] and produces undefined behavior in the FileX file system layer used by NetX Duo.

Root Cause

The root cause is improper state tracking during error handling. The shared cleanup label assumes a file handle is always valid, but the function does not verify whether fx_file_open() succeeded before reaching that label. No boolean flag or sentinel value gates the call to fx_file_close(). Any early-failure branch in PUT request parsing, authentication, or content handling reaches the cleanup label with an uninitialized or stale handle.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP PUT request to a device running the NetX Duo HTTP server. The request triggers one of several pre-open error conditions, such as malformed headers, invalid content length, or authentication failure. Control transfers to the shared cleanup label, where fx_file_close() operates on the uninitialized handle. The impact is limited to availability, consistent with denial of service or process crash on the embedded target. See the Eclipse GitLab CVE Assignment for the upstream tracking record.

Detection Methods for CVE-2026-11576

Indicators of Compromise

Unexpected reboots, watchdog resets, or task crashes on embedded devices running NetX Duo with HTTP PUT enabled
Repeated malformed HTTP PUT requests in network logs targeting NetX Duo endpoints
FileX subsystem errors or assertion failures appearing in device diagnostic logs

Detection Strategies

Inspect firmware build manifests for NetX Duo versions containing the CVE-2025-0728 cleanup refactor
Monitor HTTP traffic to embedded device management interfaces for PUT requests with anomalous headers or oversized payloads
Correlate device crash telemetry with inbound HTTP PUT activity from the same source

Monitoring Recommendations

Capture network flow data on segments containing IoT and embedded devices that expose HTTP services
Alert on repeated HTTP 4xx or 5xx responses from NetX Duo endpoints followed by loss of device availability
Enable verbose logging on the FileX layer where supported to capture file handle state during PUT processing

How to Mitigate CVE-2026-11576

Immediate Actions Required

Inventory all devices and firmware images that integrate Eclipse ThreadX NetX Duo with HTTP server support
Disable the HTTP server PUT method on affected devices where the feature is not required
Restrict network access to NetX Duo HTTP endpoints using firewall rules or network segmentation

Patch Information

Reference the Eclipse GitLab CVE Assignment for the authoritative tracking entry. Apply the corrected cleanup logic from the Eclipse ThreadX NetX Duo project once a fixed release is published. Vendors integrating NetX Duo should rebuild firmware against the patched component and distribute updates to deployed devices.

Workarounds

Block inbound HTTP PUT requests at upstream firewalls or reverse proxies fronting embedded devices
Place affected devices on isolated management VLANs accessible only to trusted hosts
Disable the HTTP server module entirely in NetX Duo builds where PUT functionality is not required

bash

# Configuration example: block HTTP PUT to embedded device segment using iptables
iptables -A FORWARD -p tcp --dport 80 -d 10.10.20.0/24 \
  -m string --algo bm --string "PUT " --from 52 --to 56 -j DROP