CVE-2026-115215

{
  "etk_id": "ETK-2026-3321",
  "cve_id": "CVE-2026-115215",
  "display_id": "CVE-2026-115215",
  "ghsa_id": "GHSA-3p2g-x7hh-3w4c",
  "euvd_id": "EUVD-2026-115638",
  "status": "published",
  "anchor_state": "anchored",
  "title": "DTLS session pool exhaustion in Eclipse ThreadX NetX Secure",
  "summary": "Eclipse ThreadX NetX Duo 6.0 through 6.5.2.202603a is affected when its NetX Secure DTLS server is enabled. An unauthenticated remote attacker can deplete available DTLS session capacity and prevent legitimate clients from using the service. The attacker must be able to send traffic to the DTLS server.",
  "mitigation": "Restrict DTLS access to trusted networks or peers and filter unnecessary inbound DTLS traffic. Monitor session-pool use and reset stalled sessions or restart the affected application to restore service until a vendor update is available.",
  "vendor": "Eclipse Foundation",
  "product": "Eclipse ThreadX",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 6.0, <= 6.5.2.202603a"
      ],
      "ecosystem": "eclipse threadx",
      "fixed_versions": [
        "6.5.2.202603b"
      ],
      "package_name": "NetX Duo",
      "purl": null
    }
  ],
  "cwes": [
    770
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 22.907112116666667,
  "t0_at": "2026-11-02T21:43:53.639000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-02T21:43:53.639000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-02T21:43:53.639000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-115215"
    }
  }
}