Allocation of Resources Without Limits or Throttling in NetX Duo - CVE-2026-115215
Published: November 9, 2026
Vulnerability identifier: #VU162968
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-115215
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to exhaust the DTLS session pool and deny service to legitimate clients.
The vulnerability exists due to the NetX Duo Secure DTLS server allocating sessions for datagrams from unknown sources before cookie verification and retaining them after handshake timeout. An unauthenticated remote attacker can send one datagram per spoofed source address or port to occupy every session until the application resets them.
Affected software
NetX Duo
How to mitigate CVE-2026-115215
Install security update from vendor's website.
NetX Duo - update to 6.5.2.202603