CVE-2026-94018: CWE-457 Use of Uninitialized Variable in Eclipse Foundation Eclipse ThreadX - NetX Duo

The vulnerability arises from the HTTP server component of the Web add-on in Eclipse ThreadX - NetX Duo. When the server processes a PUT request containing a Content-Length header that underflows, it dereferences and releases an uninitialized pointer. This use of an uninitialized variable (CWE-457) combined with improper resource release (CWE-824) can lead to undefined behavior or potential memory corruption. The flaw is reachable remotely without authentication, increasing its risk profile. The affected versions are from 6.4.2 up to and including 6.5.1.202602.

An unauthenticated remote attacker can trigger the vulnerability by sending a single malformed PUT request with a crafted Content-Length header. This can cause the server to dereference and release an uninitialized pointer, potentially leading to memory corruption, denial of service, or other undefined behavior. The CVSS 4.0 base score of 8.8 reflects a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on availability.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to restrict access to the affected HTTP server component or implement network-level protections to block malformed PUT requests with suspicious Content-Length headers.