What is the CVSS score of CVE-2026-67976?

CVE-2026-67976 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of fprime framework are affected by CVE-2026-67976?

Organizations using NASA's fprime framework v4.2.2 are exposed to unauthenticated remote denial-of-service attacks, and publicly available exploit code exists.

How to fix or mitigate CVE-2026-67976?

Within 24 hours, determine if fprime v4.2.2 is deployed anywhere in your infrastructure and catalog all affected systems-if no deployments exist, no further action is required at this time. Within 7 days, for any identified fprime v4.2.2 instances, implement network segmentation to restrict access to the Ref::SignalGen component from untrusted networks, deploy ingress monitoring for anomalous resource consumption patterns, and apply input validation to user-supplied parameters. Within 30 days, establish a continuous monitoring cadence for fprime vendor advisories and plan an upgrade pathway to a patched version once NASA releases a fix; in the interim, document all compensating controls and retest them monthly.

fprime framework CVE-2026-67976

EUVD-2026-52479 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-08-03 mitre

GHSA-q8q4-qc97-4qvh

Denial Of Service N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-accessible component accepting unauthenticated parameters; no confidentiality or integrity impact; availability fully impacted via resource exhaustion.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 16:51 vuln.today

CVE Published

Aug 03, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 03, 2026 - 00:00 cve.org

HIGH 7.5

DescriptionCVE.org

The Ref::SignalGen component of fprime framework v4.2.2 does not validate the safety of user-controlled parameters, allowing attackers to cause a Denial of Service (DoS) via inputting unsafe parameters.

AnalysisAI

Uncontrolled resource consumption in NASA's fprime framework v4.2.2 exposes the Ref::SignalGen component to remote denial-of-service attacks via unsanitized user-supplied parameters. The CVSS vector (AV:N/AC:L/PR:N/UI:N) reflects unauthenticated, low-complexity network exploitation - however, this risk must be contextualized: fprime is a niche aerospace embedded software framework, and a POC exists per SSVC data, though EPSS of 0.14% (4th percentile) signals negligible real-world exploitation interest. No public exploit has been confirmed as actively exploited, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

fprime (F') is NASA's open-source flight software framework, designed for resource-constrained embedded systems used in spacecraft and aerospace applications. The Ref::SignalGen component is a reference signal generation module within the framework, intended to demonstrate or test signal generation capabilities. CWE-400 (Uncontrolled Resource Consumption) is the root cause: the component accepts user-controlled parameters without bounding or validating resource usage, allowing an attacker to send inputs that exhaust memory, CPU, or other finite resources. The CPE data in the NVD entry is unpopulated ('n/a'), providing no additional machine-readable product identification beyond the GitHub repository at github.com/nasa/fprime. The affected version is explicitly v4.2.2 per the CVE description.

RemediationAI

No vendor-released patch version is identified in the available data at time of analysis. Operators should review the fprime GitHub repository at github.com/nasa/fprime for commits or releases addressing parameter validation in the Ref::SignalGen component following v4.2.2. The POC is documented at github.com/freedomfoxvare/cve/issues/2, which may assist in identifying whether a fix has been merged upstream. As a compensating control, restrict or disable network exposure of the Ref::SignalGen component - if this is a reference/test component, it should not be deployed in operational environments; removing it from production builds eliminates the attack surface entirely. Firewall rules or network segmentation limiting inbound parameter submissions to trusted hosts are a viable interim mitigation with minimal operational trade-off in typical embedded deployment scenarios. NVD advisory is available at nvd.nist.gov/vuln/detail/CVE-2026-67976.