What is the CVSS score of CVE-2026-22024?

CVE-2026-22024 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Cryptolib are affected by CVE-2026-22024?

CVE-2026-22024 presents moderate security risk rated CVSS 5.3. Exploitation could compromise the security of affected deployments. Proof-of-concept code is publicly available.. A patch is available.

Is there a public PoC exploit available for CVE-2026-22024?

Yes, a public proof-of-concept exploit is available for CVE-2026-22024. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-22024?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Cryptolib CVE-2026-22024

MEDIUM

Memory Leak (CWE-401)

2026-01-10 security-advisories@github.com

Denial Of Service Cryptolib

5.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Jan 16, 2026 - 16:44 vuln.today

Public exploit code

Patch released

Jan 16, 2026 - 16:44 nvd

Patch available

CVE Published

Jan 10, 2026 - 01:16 nvd

MEDIUM 5.3

DescriptionGitHub Advisory

CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, the cryptography_encrypt() function allocates multiple buffers for HTTP requests and JSON parsing that are never freed on any code path. Each call leaks approximately 400 bytes of memory. Sustained traffic can gradually exhaust available memory. This issue has been patched in version 1.4.3.

AnalysisAI

CryptoLib versions prior to 1.4.3 leak approximately 400 bytes of memory with each call to the cryptography_encrypt() function due to unfreed buffers, allowing remote attackers to conduct denial-of-service attacks against spacecraft-to-ground communications by exhausting available memory through sustained traffic. Public exploit code exists for this vulnerability. The issue is resolved in version 1.4.3 and later.

Technical ContextAI

Classified as CWE-401 (Memory Leak). Affects Cryptolib. CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, the cryptography_encrypt() function allocates multiple buffers for HTTP requests and JSON parsing that are never freed on any code path. Each call leaks approximately 400 bytes of memory. Sustained traffic can gradually exhaust available memory.