This hotfix release addresses eight vulnerabilities: two in NetX Secure, one in the ICMPv6 option walkers, and one each in the mDNS, RTSP, SNMP and TFTP add-ons. All eight are reachable without credentials or user interaction, and none requires an established session. It contains no functional changes beyond those fixes.
We thank @L0stHeart, Arash Ale Ebrahim from SYSPWN (@Microsvuln), Cipher of Causal Security (@cipher-creator), @afldl, @adawn0106 and @D7EAD for reporting these responsibly.
Vulnerabilities addressed
Eight vulnerabilities are fixed in 6.5.2.202603a. Six are reachable over the network and two from the local link. None requires privileges or user interaction.
- CVE-2026-106465 (8.7 High, CWE-290, CWE-406)
Missing HelloVerifyRequest cookie validation in the NetX Secure DTLS server - CVE-2026-106464 (8.7 High, CWE-125, CWE-191)
Out-of-bounds read via an empty signature BIT STRING in NetX Secure X.509 parsing - CVE-2026-102718 (8.7 High, CWE-125, CWE-130)
Out-of-bounds read in the NetX Duo SNMP OID parser via a multi-byte BER length - CVE-2026-102716 (8.7 High, CWE-401, CWE-755)
A malformed Session header permanently orphans one packet-pool block per RTSP request - CVE-2026-102713 (8.3 High, CWE-125, CWE-770)
Unbounded DATA datagram in the NetX Duo TFTP server causes an out-of-bounds read and a permanent stall - CVE-2026-102714 (7.1 High, CWE-125, CWE-191, CWE-835, CWE-1287)
ICMPv6 option validation accepts a trailing byte residue, sending the Router Advertisement, Neighbor Solicitation, Neighbor Advertisement and Redirect option walkers past the packet or into a permanent loop - CVE-2026-102715 (7.1 High, CWE-697, CWE-787)
mDNS string cache accepts a shorter name as a match for a longer stored one, so the known-answer encoder writes past the transmit packet - CVE-2026-102712 (6.3 Medium, CWE-125)
Out-of-bounds read in the NetX Secure DTLS ClientHello parser
All eight affect every release up to and including 6.5.2.202603, and all are fixed in 6.5.2.202603a.
The DTLS ClientHello over-read and the missing HelloVerifyRequest cookie validation share a function and were fixed together in one change. The ICMPv6 defect is the only one inside common/src; the remainder are in NetX Secure, the crypto library and the protocol add-ons.
The SNMP OID over-read was reported by @D7EAD and @adawn0106, the DTLS ClientHello over-read by @cipher-creator, @afldl and @adawn0106, the ICMPv6 option residue by @Microsvuln and @L0stHeart, and the RTSP, TFTP and mDNS defects by @L0stHeart. The X.509 empty signature BIT STRING and the missing DTLS cookie validation were found during internal review.
Seven of the eight advisories ship with a regression test that fails without its fix. The exception is CVE-2026-102715, the mDNS prefix-name match: the aliasing cannot be produced through the service API, because a record name always ends in the service and domain labels, so no such name is ever a truncation of another. Reaching it needs two crafted records through the packet injector, which is planned alongside the structural change to the string-table slot header.
You can access advisories for previously addressed vulnerabilities here.
Full Changelog: v6.5.2.202603_rel...v6.5.2.202603a