A denial of service vulnerability exists in ION-DTN before 4.2.1-a.1. Unauthenticated remote attackers can crash the ION process by sending a BPv7 bundle with a zero-length payload. The issue arises from the canonicalizePayloadBlock() function in bpsec_util.c, which passes bundle->payload.length to zco_clone() without validating it against zero. This causes a failed CHKZERO assertion that triggers sm_Abor [truncated]
PatchSiren debrief for CVE-2026-84484: ION-DTN versions before 4.2.0 contain an out-of-bounds read vulnerability in the decodeSdnv function that allows unauthenticated remote attackers to read memory by sending truncated SDNV values. This vulnerability can be triggered by sending a UDP datagram to the LTP link service input port with a truncated SDNV, potentially allowing attackers to read up to nine byte [truncated]
