EUVD-2026-75456Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, unauthenticated crash requiring no special conditions; only availability is impacted and scope is unchanged.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
ION-DTN before 4.2.1-a.1 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash the ION process by sending a BPv7 bundle with a zero-length payload. The canonicalizePayloadBlock() function in bpsec_util.c passes bundle->payload.length to zco_clone() without validating it against zero, causing a failed CHKZERO assertion that triggers sm_Abort() and terminates the process with SIGABRT before any HMAC verification occurs, requiring no valid key or credential to exploit.
AnalysisAI
Denial of service in NASA-JPL ION-DTN before 4.2.1-a.1 allows unauthenticated remote attackers to crash the ION process by sending a single crafted BPv7 bundle with a zero-length payload block. The canonicalizePayloadBlock() function in bpsec_util.c forwards bundle->payload.length directly to zco_clone() without a zero-value guard; when that value is zero, the CHKZERO assertion fails, sm_Abort() is invoked, and the process terminates via SIGABRT. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The ION-DTN daemon must be running and network-reachable, and the attacker must be able to deliver a BPv7 bundle to the target node's bundle-reception endpoint - the only prerequisite is network access to that port. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) accurately captures a straightforward network-accessible crash with zero authentication barrier - even a mid-sized municipal IT team in gniezno running a DTN research node should treat this as urgent patching rather than a deferred maintenance item. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade ION-DTN to version 4.2.1-a.1 or later, which introduces a zero-length validation guard in `canonicalizePayloadBlock()` before the call to `zco_clone()`. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and audit all systems running ION-DTN versions before 4.2.1-a.1; immediately implement firewall rules restricting BPv7 bundle reception to whitelisted trusted sources only and disable inbound DTN services on untrusted network interfaces. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-617 – Reachable Assertion
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today