Vulnerability · Published Sep 10, 2026 · Assigned by VulnCheck

CVE-2026-75584ION-DTN < 4.2.1-a.1 Denial of Service via canonicalizePayloadBlock() Assertion

High 7.5

In plain English

A high-severity security flaw in ION-DTN from nasa-jpl. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.6%top 50.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

ION-DTN before 4.2.1-a.1 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash the ION process by sending a BPv7 bundle with a zero-length payload. The canonicalizePayloadBlock() function in bpsec_util.c passes bundle->payload.length to zco_clone() without validating it against zero, causing a failed CHKZERO assertion that triggers sm_Abort() and terminates the process with SIGABRT before any HMAC verification occurs, requiring no valid key or credential to exploit.

Affected products (as reported)

Vendor	Product	Versions
nasa-jpl	ION-DTN	0 – through 4.2.0

Weakness: CWE-617 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

GitHub Security Advisory (GHSA-9vgc-2r6g-6qwf) vendor-advisory
https://www.vulncheck.com/advisories/ion-dtn-a-1-denial-of-service-via-canonicalizepayloadblock-assertion third-party-advisory