CVE-2026-75584: falha de alta gravidade em nasa-jpl ION-DTN
ION-DTN < 4.2.1-a.1 Denial of Service via canonicalizePayloadBlock() Assertion
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.7epss 0.6%
ION-DTN before 4.2.1-a.1 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash the ION process by sending a BPv7 bundle with a zero-length payload. The canonicalizePayloadBlock() function in bpsec_util.c passes bundle->payload.length to zco_clone() without validating it against zero, causing a failed CHKZERO assertion that triggers sm_Abort() and terminates the process with SIGABRT before any HMAC verification occurs, requiring no valid key or credential to exploit.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
nasa-jpl · ION-DTNCVEs relacionadas — nasa-jpl ION-DTN
No mesmo produto, das mais perigosas para as menos.
CVE-2026-84484HIGHION-DTN before 4.2.0 Out-of-Bounds Read via decodeSdnvEPSS 0.9%CVE-2024-54129CRITICALImproper Initialization of `imc` Scheme Leading to `SIGABRT` in ION-DTN BPv7EPSS 0.4%CVE-2024-54130CRITICALSegmentation Fault in `forwardBundle` Function of ION-DTN BPv7 When Destination EID is `dtn:none` (public)EPSS 0.4%CVE-2025-61910HIGHNASA ION-DTN BPv7 4.1.3s Uncontrolled Memory Allocation that leads to Denial-of-ServiceEPSS 0.4%