µD3TN EUVD-2026-115832

Exploitation requires that a µD3TN node be network-reachable and actively processing Bundle Protocol version 6 (BPv6) bundles, since the flaw is in BPv6 EID reference handling; a node restricted to BPv7 or not exposed to attacker-originated bundles would not be reachable through this path. No authentication or user interaction is needed (PR:N/UI:N). The amplification property means an attacker needs relatively little traffic to cause disproportionate memory consumption, but impact is limited to availability - no confidentiality or integrity effect (C:N/I:N). The precise malformed EID reference that triggers the leak is not described in the available sources, and no fixed version is listed in the provided data.

The signals point to a genuine but moderate-urgency availability issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a remotely reachable, low-complexity flaw needing no privileges or user interaction and affecting only availability - consistent with CWE-401 (missing release of memory) and the 'Memory Leak with Amplification' description, where small attacker inputs disproportionately consume server memory. The vuln.today decision label is 'this_week', not 'act_now' or 'emergency', so prioritize remediation within the week rather than treating it as drop-everything. No EPSS score, no CISA KEV entry, and no confirmed exploit code are present in the input, so there is no evidence of active or widespread exploitation; this is currently a severity-driven priority, not an exploitation-driven one. The main factor lowering real-world risk is deployment footprint: µD3TN is a niche Delay/Disruption-Tolerant Networking (Bundle Protocol) implementation, so exposure is limited to the relatively small population running it with BPv6 processing reachable. One data conflict to note: the input Tags include 'Information Disclosure', but the CVSS vector shows C:N/I:N/A:H and the description is a DoS - the confidentiality label is inconsistent with the vector and should be disregarded. EPSS and SSVC automatable/technical-impact fields were not supplied, so those dimensions could not be weighed.

A remote, unauthenticated attacker who can reach a µD3TN node processing Bundle Protocol version 6 sends crafted bundles whose EID references trigger a memory leak that is amplified relative to the input size. By repeating these bundles, the attacker steadily exhausts the node's memory until it degrades or crashes, denying service to legitimate DTN traffic. No public exploit code is identified in the provided data; the referenced GitLab work item is the vendor issue tracker entry, not verified working exploit code.