This hotfix release addresses thirteen vulnerabilities: three in NetX Secure, three in the TSN components, and one each in ICMPv6, the BSD layer, the DHCP client, the FTP client, the FTP server, PPP and TFTP. Eight are reachable over the network and five from the local link or segment. None requires credentials; one, in the FTP server, needs a legitimate user's transfer in progress. Apart from those fixes, it adds one NetX Secure service for the new DTLS cookie secret.
We thank Team Atlanta, OSTIF and Shielder (@suidpit, @acorn421), SecMate (@max-r-b, @enitmar) and VulnCheck (@wsparks-vc), @L0stHeart, @adawn0106, @tinic and zhangph (@afldl) for reporting these responsibly.
Vulnerabilities addressed
Thirteen vulnerabilities are fixed in 6.5.2.202603b.
- CVE-2026-114408 (8.7 High, CWE-252, CWE-476)
NULL pointer dereference in ICMPv6 Packet Too Big processing when the destination table is full - CVE-2026-115215 (8.7 High, CWE-770, CWE-772)
NetX Secure DTLS server allocates a session for each new source before the cookie exchange and never reclaims it, so spoofed datagrams exhaust the session pool - CVE-2026-115403 (8.2 High, CWE-252, CWE-476)
NULL pointer dereference in the BSD raw IPv6 send path when the destination table is full - CVE-2026-102723 (7.1 High, CWE-476, CWE-772)
NULL Pointer Dereference on MSRP Attribute Table Exhaustion - CVE-2026-102724 (7.1 High, CWE-476)
NULL pointer dereference when evicting the last MSRP attribute in a participant's list - CVE-2026-102725 (7.1 High, CWE-125)
Out-of-bounds Read from Unvalidated MSRP Attribute List Length - CVE-2026-102726 (7.1 High, CWE-125, CWE-835)
Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read - CVE-2026-102721 (6.9 Medium, CWE-125)
TFTP client and server copy the ERROR packet message without bounding the read against the packet - CVE-2026-102722 (6.9 Medium, CWE-918)
The FTP client trusts arbitrary IP addresses in the PASV server response - CVE-2026-102719 (6.3 Medium, CWE-338)
NetX Secure DTLS server issues predictable HelloVerifyRequest cookies, so a spoofed client can pass the return-routability check - CVE-2026-102728 (6.3 Medium, CWE-126)
Out-of-bounds reads in NetX Secure client-side handshake parsing (ServerHello and HelloVerifyRequest) - CVE-2026-102727 (6.0 Medium, CWE-923)
FTP Passive Data Connection Not Bound to the Authenticated Control Peer - CVE-2026-102720 (5.3 Medium, CWE-125, CWE-193)
DHCP client option walk drifts one byte per skipped option, reading past the received message and past the saved options buffer
All thirteen affect releases up to and including 6.5.2.202603a; each advisory gives its first affected release.
Behaviour changes
- The DTLS server answers an initial ClientHello with a stateless HelloVerifyRequest and allocates a session only for a ClientHello that returns a valid cookie. The cookie is an HMAC over the client's address, ports and ClientHello under a rotating server secret;
nx_secure_dtls_server_cookie_secret_setlets the application supply that secret.NX_SECURE_DTLS_COOKIE_LENGTHmust now be between 17 and 255. - The FTP server refuses a passive data connection from any host other than the control connection's peer, which also ends server-to-server (FXP) transfers.
- The FTP client's IPv4 passive mode connects to the control connection's peer and uses only the port from the server's reply.
Every fix ships with a regression test that fails without it.
You can access advisories for previously addressed vulnerabilities here.
Full Changelog: v6.5.2.202603a_rel...v6.5.2.202603b_rel