When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without checking that the cookie fits in the outgoing packet

NetX Duo's WebSocket client resets the unmasking cursor to the first `NX_PACKET` each time it advances through a chained packet, while the loop's upper bound belongs to the…

Potential out of bound read in _nx_secure_tls_process_clienthello()

The TFTP server accepts a DATA datagram of any size

On the first DTLS ClientHello, the parser copies a device-claimed session_id length and validates the ciphersuite-list length against the total record length instead of the…

The NetX Secure DTLS server sends a HelloVerifyRequest carrying a freshly generated cookie, but never checks the cookie a client returns

`_nx_secure_x509_parse_signature_data` computes the certificate signature's length as `tlv_length - 1` without first checking that `tlv_length` is non-zero

hey, `_nx_snmp_utility_object_id_get` in the NetX Duo SNMP addon does not validate the claimed OID data length against the actual buffer size when the OID uses BER multibyte…

When NetX Secure is built with `NX_SECURE_KEY_CLEAR`, every TLS record sent on an active session is wiped after it has been handed to TCP

The NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH message

MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash

Two client-side TLS/DTLS handshake parsers in NetX Secure read fields from a server-supplied message before validating that the message is long enough to contain them

The `_nx_secure_x509_asn1_tlv_block_parse()` function parses ASN.1 TLV (tag-length-value) blocks out of DER-encoded data

Web http client: Unchecked Server-Side Malicious Packet Issue

Potential out-of-bounds read in _nx_icmpv6_validate_options()

`_nx_icmpv6_validate_options()` scans the option area with `while (length > 2)` (`common/src/nx_icmpv6_validate_options.c:79`)

In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's `227` reply

A TFTP server that answers with a short ERROR packet makes the client read up to 64 bytes past the received datagram

Potential out of bound read in _nx_ip_packet_receive()

Potential out of bound read issue in _nx_ipv4_packet_receive() in NetX Duo

NetX Secure TLS accepts an empty application-data record without verifying its message authentication code

Inadequate bounds check and potential underflow in _ux_host_class_hid_report_descriptor_get()

FTP Passive Data Connection Not Bound to the Authenticated Control Peer

Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read

Out-of-bounds Read from Unvalidated MSRP Attribute List Length

NULL Pointer Dereference When Evicting the Sole MSRP Attribute

NULL Pointer Dereference on MSRP Attribute Table Exhaustion

Out of bound read and write in _nx_ipv4_packet_receive() when handling unicast DHCP messages

Potential out of bound read in _nx_ipv4_option_process()

Out of bound read in _nx_secure_tls_proc_clienthello_supported_versions_extension()

Broken bounds check in Broken bounds check in _nx_secure_tls_process_clienthello_psk_extension()

Potential out of bound read and info leak in_nx_secure_tls_psk_identity_find()