CVE-2026-75584 nasa-jpl CVE debrief

Who should care

Defenders and administrators responsible for ION-DTN installations should assess exposure and prioritize patching to prevent potential denial of service attacks. ION-DTN operators, platform administrators, and security teams need to verify the ION-DTN version and apply patches. Vulnerability management and security teams should review configurations and monitor for potential denial of service attacks.

Why it matters

Defenders should prioritize verifying the ION-DTN version and applying patches to prevent potential denial of service attacks. The vulnerability allows unauthenticated remote attackers to crash the ION process, and its impact on mission-critical systems and services requires verification and mitigation.

• Potential denial of service attacks against ION-DTN installations
• Verification of ION-DTN version and patch level is required
• Potential impact on mission-critical systems and services

Technical summary

The canonicalizePayloadBlock() function in bpsec_util.c passes bundle->payload.length to zco_clone() without validating it against zero, causing a failed CHKZERO assertion that triggers sm_Abort() and terminates the process with SIGABRT before any HMAC verification occurs. This issue affects ION-DTN before 4.2.1-a.1, allowing unauthenticated remote attackers to crash the ION process by sending a BPv7 bundle with a zero-length payload. The vulnerability requires no valid key or credential to exploit and impacts mission-critical systems and services.

Defensive priority

Defenders should prioritize verifying the ION-DTN version and applying patches to prevent potential denial of service attacks.

Recommended defensive actions

• Verify ION-DTN version and apply patches
• Review and update configurations to prevent exploitation
• Monitor for potential denial of service attacks
• Perform vulnerability assessment and prioritize patching
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and NVD entry provide details about the vulnerability. Further verification is needed to determine the exact scope of affected versions and potential impact. Defenders should verify ION-DTN version and patch level, review configurations, and monitor for potential denial of service attacks. Evidence from the CVE Program and NVD detail page supports this assessment, but additional source references may be necessary to fully understand the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.