Sleapi J
Monthly
Denial of service in ESA's SLE API for Java (all versions prior to 5.1.7) allows an unauthenticated remote client of the SLE listening service to crash or degrade the service by sending a crafted ISP1 TML/PDU message whose 4-byte big-endian body-length field drives an unbounded byte-array allocation. Because the CVSS vector is PR:N/UI:N and no non-default feature toggle is required, any network-reachable instance in a standard configuration is exposed; however, the practical attacker set is narrowed by the fact that SLE endpoints are typically confined to space-agency ground-segment operational networks rather than the public internet. The flaw is fixed in 5.1.7, and no public exploit code was identified at time of analysis.
Denial of service in ESA's SLE API for Java (all versions prior to 5.1.7) allows an unauthenticated remote client of the SLE listening service to crash or degrade the service by sending a crafted ISP1 TML/PDU message whose 4-byte big-endian body-length field drives an unbounded byte-array allocation. Because the CVSS vector is PR:N/UI:N and no non-default feature toggle is required, any network-reachable instance in a standard configuration is exposed; however, the practical attacker set is narrowed by the fact that SLE endpoints are typically confined to space-agency ground-segment operational networks rather than the public internet. The flaw is fixed in 5.1.7, and no public exploit code was identified at time of analysis.