{"id":"CVE-2026-121507","kind":"vulnerability","aliases":["CVE-2026-121507"],"related":[],"title":"µD3TN BPv6 fragmenter: double free lets a remote attacker crash the service","description":"Double Free in µD3TN BPv6 Fragmenter Block Duplication allows Unauthenticated Remote Attacker to Cause DoS on Allocation Failure","summary":"The µD3TN Bundle Protocol v6 fragmenter frees memory twice when block duplication hits an allocation failure. An unauthenticated remote attacker can trigger this to cause a denial of service.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bpv6","delay-tolerant-networking","mud3tn","runtime"],"not_affected_if":["bpv6-not-used"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-03T15:17:37+00:00","first_seen_at":"2026-11-03T15:22:01+00:00","triaged_at":"2026-11-03T15:23:23+00:00","updated_at":"2026-11-03T15:23:23+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-11-03T15:23:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"µD3TN BPv6 fragmenter: double free lets a remote attacker crash the service","impact":"low","summary":"The µD3TN Bundle Protocol v6 fragmenter frees memory twice when block duplication hits an allocation failure. An unauthenticated remote attacker can trigger this to cause a denial of service.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["mud3tn","bpv6","delay-tolerant-networking"],"confidence":0.4,"fix_status":"unknown","needs_auth":"no","worst_case":"service crashes, causing denial of service on the node","analyst_note":"Check NVD and the µD3TN project advisory for affected versions, the fixed version and whether the BPv6 fragmenter is enabled by default.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["bpv6-not-used"],"who_is_affected":"Systems running µD3TN with the BPv6 fragmenter enabled are the ones exposed, and the sources do not say which versions or configurations are affected. Teams that do not run µD3TN can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000634,"input_tokens":4098,"output_tokens":448,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121507':15A,18A '-2026':14A,17A 'alloc':40B,71C 'allow':63C 'attack':9A,45B,66C 'block':36B,61C 'bpv6':2A,19B,59C 'bundl':28B 'caus':50B,68C 'crash':10A 'cve':13A,16A 'delay':21B 'delay-tolerant-network':20B 'denial':52B 'dos':69C 'doubl':4A,55C 'duplic':37B,62C 'failur':41B,72C 'fragment':3A,31B,60C 'free':5A,32B,56C 'hit':38B 'let':6A 'memori':33B 'mud3tn':24B 'network':23B 'protocol':29B 'remot':8A,44B,65C 'runtim':25B 'servic':12A,54B 'toler':22B 'trigger':47B 'twice':34B 'unauthent':43B,64C 'v6':30B 'µd3tn':1A,27B,58C","nicknames":[],"mitigations":[],"who_affected":"Systems running µD3TN with the BPv6 fragmenter enabled are the ones exposed, and the sources do not say which versions or configurations are affected. Teams that do not run µD3TN can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bpv6","delaytolerantnetworking","medium","mud3tn","runtime"],"first_public_at":"2026-11-03T15:17:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121507","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121507","severity":null,"published_at":"2026-11-03T15:17:37+00:00","modified_at":"2026-11-03T15:17:37+00:00","first_seen_at":"2026-11-03T15:22:01+00:00","fetched_at":"2026-11-03T15:22:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}