CVE-2025-61910
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
ION-DTN 4.1.3s contains a vulnerability involving uncontrolled memory allocation when processing a BPv7 bundle with a malformed extension block, leading to receiver thread termination and DoS. The issue is due to a conversion of block length from unsigned int to signed int, causing an attempt to allocate an unrealistic amount of memory.
Risk Assessment
An attacker can send a specially crafted bundle, causing receiver failure and unavailability of DTN services, potentially disrupting communication in high-latency networks.
Recommendation
Monitor for patches for ION-DTN and apply them when available. Restrict access to DTN networks and filter BPv7 bundles.
Other vulnerabilities in ION-DTN
See all- CVE-2026-75584High
ION-DTN before 4.2.1-a.1 contains a denial of service vulnerability. An unauthenticated remote attacker can crash the ION process by sending a BPv7 bundle with a zero-length payload, causing a failed CHKZERO assertion and process termination with SIGABRT.
- CVE-2026-84484High
ION-DTN before version 4.2.0 contains an out-of-bounds read vulnerability in the decodeSdnv function that allows unauthenticated remote attackers to read memory by sending truncated SDNV values. Attackers can send a UDP datagram to the LTP link service input port with a truncated SDNV to trigger reads up to nine bytes past buffer boundaries and underflow byte counters.
Original NVD description (English source)
The NASA’s Interplanetary Overlay Network (ION) is an implementation of Delay/Disruption Tolerant Networking (DTN). A BPv7 bundle with a malformed extension block causes uncontrolled memory allocation inside ION-DTN 4.1.3s, leading to receiver thread termination and a Denial-of-Service (DoS). The triggering bundle contains an extension block starting at `0x85070201005bbb0e20b4ea001a000927c0...`. The first byte in the extension block (0x85) indicates a CBOR array of five elements of which the first four are numbers (0x07, 0x02, 0x01, 0x00) but the fifth element is a byte string of length 27 (`0x5bbb0e20b4ea001a000927c0...`). The vulnerability seems to be due to processing the fifth element of the array (i.e., the byte string) as replacing it with a number makes the vulnerability no longer be triggered. While parsing this extension block, ION obtains a very large block length, which in the code in `bei.c`:764) seems to be passed from `blockLength` which is an unsigned int, to a 32 bit signed integer `blkSize`. The unsigned to signed conversion causes `blkSize` to hold the value of -369092043, which is then converted into a 64-bit unsigned value inside `MTAKE(blkSize)`, resulting in an attempt to allocate an unrealistic amount of memory, causing the error. As of time of publication, no known patched versions of BPv7 exist.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS