CVE-2026-102726

In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the PPP IPCP code parses a peer's Configure-Nak without validating each option's length. A malicious PPP peer can stall the PPP thread indefinitely with a zero-length option, taking the link down, and can read back up to four bytes of packet-buffer memory per exchange with a short address option.

• https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-2wwp-ffgp-6ggj