CVE-2025-55085
Web http client: Unchecked Server-Side Malicious Packet Issue
- State
- Published
- Severity
- 8.8 High
- Published
- Oct 17, 2025
- Updated
- Oct 20, 2025
- Reserved
- Aug 6, 2025
Description
In NextX Duo before 6.4.4, in the HTTP client module, the network support code for Eclipse Foundation ThreadX, the parsing of HTTP header fields was missing bounds verification. A crafted server response could cause undefined behavior.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.8 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N | eclipse |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
NetX DuoEclipse Foundation |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.