CVE-2025-55081
Critical · CVSS 9.1- CVSS
- 9.1
- nvd
- EPSS
- 0.37%
- 29th pct
- KEV
- No
- Class
- oss containerizable
- CWE-126, CWE-125
Description
In Eclipse Foundation NextX Duo before 6.4.4, a module of ThreadX, the _nx_secure_tls_process_clienthello() function was missing length verification of certain SSL/TLS client hello message: the ciphersuite length and compression method length. In case of an attacker-crafted message with values outside of the expected range, it could cause an out-of-bound read.
References
Status: profiled · ingested 2026-10-08T12:00:43.000Z