EUVD-2026-115833
GHSA-q435-pvgg-gggw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach µD3TN SPP listener over network
-
DeliverySend crafted SPP packet
-
ExploitTrigger off-by-one heap write in parser
-
ExecutionCorrupt adjacent heap memory
-
ImpactCrash daemon, deny service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network reachability to a µD3TN v0.15.1 instance whose SPP (Space Packet Protocol) parser/convergence layer processes attacker-supplied packets; the attacker sends a malformed SPP packet that drives the off-by-one heap write. Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is needed. Limiting factors: the affected version is specifically v0.15.1 and the SPP parsing path must be reachable from the attacker's network position; realized impact is confined to denial of service (availability), with no confirmed confidentiality, integrity, or code-execution consequence in the available sources. |
| Impact | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) is internally consistent with the description: a remotely reachable, unauthenticated, low-complexity flaw whose only impact is availability (DoS), matching the stated 'Reliably Cause DoS.' With PR:N the vector indicates unauthenticated exploitation. The vuln.today decision label is 'this_week,' indicating a near-term but not emergency priority. Crucially, several key exploitation signals are MISSING from the input: no EPSS probability is provided, there is no CISA KEV entry (not actively exploited per available data), and no confirmed public exploit/PoC code is supplied - the only reference is the vendor's own GitLab work item (issue tracker), not verified exploit code. The off-by-one heap overflow (CWE-787) is a memory-corruption write, which in principle could escalate beyond DoS, but the reporter and CVSS explicitly scope impact to availability only (C:N/I:N); the available sources do not claim code execution, so this should be treated as a reliable DoS rather than RCE. Net assessment: a genuine, remotely triggerable availability risk for anyone running the affected µD3TN SPP parser, tempered by the product's narrow deployment footprint and the absence of EPSS/KEV/PoC corroboration. This is a real 'patch this week' issue for DTN/space-networking operators, but not a widespread internet-emergency given the niche product base. |
| Exploit ScenarioDerived | An unauthenticated attacker with network reachability to a µD3TN v0.15.1 node exposing the SPP (Space Packet Protocol) parser sends a single crafted SPP packet that triggers an off-by-one write past a heap buffer, corrupting adjacent heap memory and crashing the daemon to reliably deny service. Because the vector is network, low-complexity, and requires no authentication or user interaction, the attack can be repeated to keep the node offline. No verified public exploit code is identified in the available data - the only reference is the vendor's GitLab work item. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Heap-based buffer overflow in the Space Packet Protocol (SPP) parser of µD3TN v0.15.1 allows an unauthenticated remote attacker to reliably crash the DTN node, a denial-of-service condition rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The off-by-one out-of-bounds write corrupts heap memory and aborts the process; confidentiality, integrity, and code-execution impacts are not confirmed in the available sources. No public exploit was identified at time of analysis, and the CVE is not listed in CISA KEV.
RemediationAI
No vendor-released patch was identified in the available data at time of analysis; the only supplied reference is the GitLab work item https://gitlab.com/d3tn/ud3tn/-/work_items/288, which should be tracked for an official fix and any released version. Until a patched release is available, reduce exposure by restricting network reachability to µD3TN instances and their SPP convergence-layer endpoints so that only trusted DTN peers can send packets, for example with host or network firewall rules - the trade-off is that legitimate but untrusted peers are also blocked, which may disrupt wide-area DTN topologies. If SPP convergence-layer interoperability is not required in a given deployment, disabling that convergence layer removes the vulnerable parsing path, at the cost of losing SPP-based links. Deploying µD3TN behind a filtering proxy or gateway that rejects malformed or inconsistent SPP packets can absorb the crafted input before it reaches the node, but such filtering must correctly parse the protocol and is a compensating control rather than a complete fix. Given the this_week priority label and the availability-only impact, remediation should be scheduled within the current week, with the vendor work item monitored for a fixed release.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
µD3TN is a Delay-Tolerant Networking (DTN) implementation that provides Bundle Protocol and convergence-layer support, and the affected component is its Space Packet Protocol (SPP) convergence layer/parser. The flaw is classified as CWE-787 (out-of-bounds write) and is specifically described as an off-by-one heap overflow: when the SPP parser processes a malformed or crafted packet, it writes one byte beyond the boundary of an allocated heap buffer, corrupting heap metadata and leading to an abort or crash of the µD3TN process. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates the vulnerable parsing path is reachable over the network, that no authentication or user interaction is required, and that the only assessed impact is loss of availability. The precise packet fields and parser conditions that produce the off-by-one are not described in the available sources beyond the malformed SPP packet trigger, and the provided CPE for d3tn_gmbh:µd3tn uses a wildcard version, while the description pins the affected release to v0.15.1.
Know when D3Tn gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated crafted packet to the SPP parser (AV:N/AC:L/PR:N/UI:N); impact is DoS only, so C:N/I:N/A:H with unchanged scope.
Primary rating from Vendor (GitLab).
CVSS VectorVendor: GitLab
Lifecycle Timeline
2DescriptionCVE.org
Off-by-one Heap Overflow in µD3TN v0.15.1 SPP Parser allows Unauthenticated Remote Attacker to Reliably Cause DoS
Executive ViewAI
A high-severity denial-of-service vulnerability in µD3TN v0.15.1's Space Packet Protocol parser can be triggered remotely without authentication, crashing DTN nodes and disrupting delay-tolerant networking operations. Leadership should care because affected nodes could suffer availability outages, impacting mission-critical data relay in space or remote environments.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting network access to the SPP parser via firewall rules, deploying IPS signatures to block malformed packets, and isolating affected nodes to limit exposure.
Threat Intelligence Overview
NVD
CVE.org
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Memory exhaustion through amplified BPv6 EID reference handling in µD3TN can let remote attackers degrade or crash a net
An unauthenticated remote heap out-of-bounds write in µD3TN's Bundle Protocol version 6 (BPv6) administrative record par
Heap out-of-bounds read in µD3TN's BPv6/BPv7 fragmenter lets a local attacker with low privileges read process memory an
µD3TN daemon crashes and denial of service can result from a use-after-free in the Bundle Protocol version 6 (BPv6) frag
Denial of service in µD3TN allows an unauthenticated, remote sender of BPv6 (Bundle Protocol version 6) traffic to crash
Exploit-DB