What is the CVSS score of CVE-2026-67973?

CVE-2026-67973 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of NASA cFS are affected by CVE-2026-67973?

NASA Core Flight System v7.0.1 contains a denial-of-service vulnerability that allows unauthenticated network attackers to crash flight software by sending replayed protocol messages.

How to fix or mitigate CVE-2026-67973?

Within 24 hours: Conduct an inventory of all systems running NASA cFS v7.0.1 and classify them by operational criticality. Within 7 days: Implement network access controls and segmentation to restrict CFDP protocol traffic to only trusted, authorized sources, and consult NASA's published guidance for interim mitigations. Within 30 days: Establish a patching roadmap to upgrade to a patched version once NASA releases a fix, coordinate with system owners on deployment schedules, and validate network monitoring controls are detecting replayed PDU patterns.

NASA cFS CVE-2026-67973

EUVD-2026-52510 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-08-03 mitre

GHSA-q2fh-273g-4qm9

Denial Of Service N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable CFDP endpoint requires no authentication to receive PDUs; impact is availability-only with no confidentiality or integrity loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 16:52 vuln.today

CVE Published

Aug 03, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 03, 2026 - 00:00 cve.org

HIGH 7.5

DescriptionCVE.org

An issue in the CFDP receive path of NASA cFS v7.0.1 allows attackers to cause a Denial of Service (DoS) via replaying final CFDP PDUs.

AnalysisAI

Denial of service in NASA Core Flight System (cFS) v7.0.1 results from insufficient replay protection in the CFDP (CCSDS File Delivery Protocol) receive path, enabling unauthenticated network attackers to crash or disrupt the flight software stack by sending replayed final CFDP PDUs. SSVC classifies this as automatable with a proof-of-concept available, though the EPSS score of 0.14% (4th percentile) reflects the narrow operational footprint of aerospace flight software. No CISA KEV listing confirms active exploitation at time of analysis.

Technical ContextAI

NASA Core Flight System (cFS) is an open-source reusable flight software framework developed by NASA Goddard Space Flight Center, deployed in spacecraft, satellites, and ground control systems. CFDP (CCSDS File Delivery Protocol) is a standardized space data link protocol for reliable file transfers between ground and space segments, operating over UDP or TCP. The vulnerability resides in the CFDP receive path of cFS v7.0.1, where the implementation fails to properly validate or reject replayed 'final' PDUs - specifically end-of-file or closure PDUs that mark transaction completion. CWE-400 (Uncontrolled Resource Consumption) describes the root cause: repeated processing of replayed final PDUs likely triggers redundant state machine transitions, memory allocations, or processing loops that exhaust system resources. The CPE entry (cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*) provided by NVD is non-descriptive; the affected product is confirmed as cFS v7.0.1 directly from the CVE description and the GitHub issue at https://github.com/nasa/cFS/issues/1075.

RemediationAI

No vendor-released patched version is identified in the available data; the GitHub issue at https://github.com/nasa/cFS/issues/1075 should be monitored for an upstream fix, commit, or tagged release. Until a patch is available, operators should restrict network access to CFDP-facing interfaces using firewall rules or network segmentation, ensuring only trusted ground stations with known IP addresses can transmit CFDP PDUs to cFS instances - this directly reduces attack surface given AV:N exploitation requires network reachability. Mission teams should additionally consider implementing PDU sequence number or transaction-ID replay validation at the application layer as a compensating control, though this requires cFS application-level modifications and testing against mission-specific configurations. Air-gapped deployments are inherently less exposed but should still apply the upstream patch once released to eliminate residual insider or insider-adjacent threat vectors.