中
6.9
NetX Duo Web HTTP server interprets request body content as HTTP header fields
CVE-2026-93003
SecPulse初出
影響パッケージ
| 種類 | パッケージ | 影響を受ける版 | 直った版 |
|---|---|---|---|
| Eclipse Foundation | Eclipse ThreadX - NetX Duo |
6.5.1.202602 以前 |
— |
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A header field name placed in the request body is therefore reported to the server as though it were a header, which lets a client control request framing decisions it should not be able to reach.
出典: NIST National Vulnerability Database NVD GitHub Advisory
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov