CVE-2026-93003: CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in Eclipse Foundation Eclipse ThreadX - NetX Duo

The vulnerability identified as CVE-2026-93003 affects the Eclipse ThreadX - NetX Duo Web add-on HTTP server. The server improperly parses HTTP requests by scanning the entire request packet for header fields rather than stopping at the end of the header section. This behavior allows an attacker to insert a header field name within the request body, causing the server to misinterpret it as a legitimate header. This inconsistent interpretation of HTTP requests is classified under CWE-444 and can lead to HTTP Request/Response Smuggling attacks. The affected versions are from 0 up to and including 6.5.1.202602. The CVSS 4.0 base score is 6.9, indicating medium severity, with network attack vector, low attack complexity, no privileges or user interaction required, and limited impact on confidentiality and availability.

An attacker can manipulate how the HTTP server frames requests by injecting header fields into the request body, which the server incorrectly treats as headers. This can lead to HTTP Request/Response Smuggling, potentially allowing an attacker to bypass security controls, poison web caches, or interfere with request routing. However, no known exploits are reported in the wild, and the impact is rated medium severity.

No official patch or remediation information is provided in the vendor advisory or input data. Patch status is not yet confirmed — check the Eclipse Foundation advisory for current remediation guidance. Until a fix is available, users should monitor vendor communications for updates and consider mitigating controls if applicable.