CVE-2026-75584
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
ION-DTN before 4.2.1-a.1 contains a denial of service vulnerability. An unauthenticated remote attacker can crash the ION process by sending a BPv7 bundle with a zero-length payload, causing a failed CHKZERO assertion and process termination with SIGABRT.
Risk Assessment
The attack requires no valid key or credentials, so anyone able to send a BPv7 bundle can cause a service crash. This may disrupt communications relying on ION-DTN.
Recommendation
Update ION-DTN to version 4.2.1-a.1 or later. Until then, consider restricting network access to the ION service.
Other vulnerabilities in ION-DTN
See all- CVE-2026-84484High
ION-DTN before version 4.2.0 contains an out-of-bounds read vulnerability in the decodeSdnv function that allows unauthenticated remote attackers to read memory by sending truncated SDNV values. Attackers can send a UDP datagram to the LTP link service input port with a truncated SDNV to trigger reads up to nine bytes past buffer boundaries and underflow byte counters.
- CVE-2025-61910High
ION-DTN 4.1.3s contains a vulnerability involving uncontrolled memory allocation when processing a BPv7 bundle with a malformed extension block, leading to receiver thread termination and DoS. The issue is due to a conversion of block length from unsigned int to signed int, causing an attempt to allocate an unrealistic amount of memory.
Original NVD description (English source)
ION-DTN before 4.2.1-a.1 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash the ION process by sending a BPv7 bundle with a zero-length payload. The canonicalizePayloadBlock() function in bpsec_util.c passes bundle->payload.length to zco_clone() without validating it against zero, causing a failed CHKZERO assertion that triggers sm_Abort() and terminates the process with SIGABRT before any HMAC verification occurs, requiring no valid key or credential to exploit.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS