CVE-2026-102716

In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the RTSP server returns a raw parser error for a malformed Session header and never releases the response packet it allocated. An unauthenticated client can drain the server's packet pool with a few dozen requests, stopping the RTSP server and, where the pool is shared, the rest of the network stack until the device restarts.

• https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-q462-246c-x3jc