EUVD-2026-52508
GHSA-p5hx-9q84-87hp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SBN accepts unauthenticated peer packets by design so PR:N and AV:N are correct; impact is availability-only with no scope change, matching the crash-only DoS behavior described.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
A parser boundary flaw in the Software Bus Network (SBN) application's peer subscription message handling in NASA cFS v7.0.1 allows attackers to cause a Denial of Service (DoS) via sending a crafted packet.
AnalysisAI
Remote denial of service in NASA Core Flight System (cFS) v7.0.1 allows unauthenticated network attackers to crash the Software Bus Network (SBN) application by sending a crafted peer subscription packet that triggers a parser boundary flaw. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U vector confirms no authentication or user interaction is required, making this trivially reachable against any exposed SBN interface. Despite the high CVSS score of 7.5, the EPSS score of 0.16% at the 5th percentile and absence of a CISA KEV listing or public exploit code suggest no public exploitation activity at time of analysis.
Technical ContextAI
NASA's Core Flight System (cFS) is an open-source, reusable flight software framework designed primarily for spacecraft and aerospace mission applications. The Software Bus Network (SBN) is a cFS plug-in application that enables inter-node Software Bus messaging across networked flight computers, allowing processes on different nodes to publish and subscribe to messages as if they were on the same local bus. The vulnerability is classified as CWE-20 (Improper Input Validation), with the root cause being a 'parser boundary flaw' in the peer subscription message handling logic - the parser fails to properly validate the bounds or structure of incoming peer subscription packets, which can lead to an out-of-bounds read, unexpected state, or process crash that terminates the SBN application. The CPE identifier provided (cpe:2.3:a:n/a:n/a) is uninformative and does not enumerate product scope beyond what the description states; the canonical source is the GitHub repository at https://github.com/nasa/cFS.
RemediationAI
No vendor-released patch version has been identified at time of analysis. The issue is tracked at https://github.com/nasa/cFS/issues/1074, which should be monitored for upstream fixes and tagged releases. As compensating controls, operators should restrict network reachability of the cFS SBN peer subscription interface to only trusted, known peer nodes using host-based or network-level firewall rules - this directly neutralizes the AV:N attack vector and is the most impactful mitigation with no functional side effects for closed mission networks. If inter-node messaging via SBN is not required for the specific mission configuration, disabling the SBN application entirely removes the attack surface, though this prevents distributed Software Bus communication across nodes. Where network filtering is not feasible, deploying an ingress packet filter or application-layer gateway to validate peer subscription message structure before forwarding to the SBN process provides an additional layer. Monitor https://github.com/nasa/cFS for patch availability.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-20 – Improper Input Validation
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today