CVE-2026-22026
HighSummary
CryptoLib before version 1.4.3 contains a vulnerability in the write_callback function of the KMC crypto service client, which does not limit the size of HTTP response buffers. A malicious KMC server can send an arbitrarily large response, causing unbounded memory growth and process termination by the OS.
Risk Assessment
An attacker controlling the KMC server can exhaust client memory and cause a crash, disrupting communication between the spacecraft and ground station, potentially leading to system downtime.
Recommendation
Upgrade CryptoLib to version 1.4.3 or later immediately, as it includes a fix that limits the response buffer size.
Other vulnerabilities in CryptoLib
See all- CVE-2026-22697High
CryptoLib before version 1.4.3 contains a heap buffer overflow vulnerability when decoding Base64 fields in JSON responses from the KMC service. The destination buffer is sized based on expected output length, but the Base64 decoder writes based on actual input length, allowing out-of-bounds writes.
- CVE-2026-22023High
CryptoLib prior to version 1.4.3 contains an out-of-bounds heap read vulnerability in the cryptography_aead_encrypt() function. The issue has been fixed in version 1.4.3.
- CVE-2026-21898High
CryptoLib before version 1.4.3 contains a vulnerability involving memory read without proper bounds checking when parsing AOS frame hashes. The issue has been fixed in version 1.4.3.
- CVE-2026-21897High
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, the Crypto_Config_Add_Gvcid_Managed_Parameters function only checks whether gvcid_counter > GVCID_MAN_PARAM_SIZE. As a result, it allows up to the 251st entry, which causes a write past the end of the array, overwriting gvcid_counter located immediately after gvcid_managed_parameters_array[250]. This leads to an out-of-bounds write, and the overwritten gvcid_counter may become an arbitrary value, potentially affecting the parameter lookup/registration logic that relies on it. This issue has been patched in version 1.4.3.
Original NVD description (English source)
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, the libcurl write_callback function in the KMC crypto service client allows unbounded memory growth by reallocating response buffers without any size limit or overflow check. A malicious KMC server can return arbitrarily large HTTP responses, forcing the client to allocate excessive memory until the process is terminated by the OS. This issue has been patched in version 1.4.3.