{"id":"CVE-2026-121510","kind":"vulnerability","aliases":["CVE-2026-121510"],"related":[],"title":"µD3TN BPv6 admin record parser: remote heap write causes denial of service","description":"Remote Unauthenticated Heap Out-of-Bounds Write in µD3TN BPv6 Administrative Record Parser allows Unauthenticated Remote Attacker to Reliably Cause DoS","summary":"µD3TN's BPv6 administrative record parser allocates source EID length + 1 bytes but a declared length of 0 makes its 16-bit counter underflow to 65535, so one unauthenticated bundle writes up to 65535 attacker-chosen bytes past a 1-byte heap buffer. The reporter reproduced a node crash; code execution is not excluded. A public PoC bundle is in the issue. Fixed in v0.15.2.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ud3tn","fixed":["0.15.2"],"affected":"< 0.15.2 (lower bound not stated by the maintainer)","ecosystem":"vendor"}],"ecosystems":[],"tags":["bpv6","delay-tolerant-networking","heap-overflow","network-reachable","other","ud3tn","unauthenticated"],"not_affected_if":["cla-not-exposed","v0.15.2-or-later"],"how_to_check":"Run your µD3TN build's version (or git tag) and confirm it is v0.15.2 or later; anything older is affected per the CVE record. You are exposed only if the node listens on a mtcp, smtcp or TCPCLv3 convergence layer reachable by untrusted peers. Also check any BPv6 deployment built from master before the v0.15.2 release.","fix":"Upgrade µD3TN to v0.15.2 (released 2026-10-26); the changelog lists this fix (#289) under Security.","status":"open","published_at":"2026-11-03T15:17:38+00:00","first_seen_at":"2026-11-03T15:22:01+00:00","triaged_at":"2026-11-03T15:22:49+00:00","updated_at":"2026-11-03T15:26:28+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-03T15:22:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"µD3TN BPv6 admin record parser: remote heap write causes denial of service","impact":"low","summary":"The µD3TN BPv6 administrative record parser has a heap out-of-bounds write that an unauthenticated remote attacker can trigger. The sources say it reliably causes a denial of service.","audience":"developers","category":"other","nicknames":[],"who_cares":["ud3tn","bpv6","delay-tolerant-networking"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote unauthenticated attacker crashes the service reliably, causing denial of service","analyst_note":"Check the NVD entry and the µD3TN project advisory for affected versions, the BPv6 admin record feature conditions, and any fixed release.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000599,"input_tokens":4112,"output_tokens":376,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the µD3TN project advisory for affected versions, the BPv6 admin record feature conditions, and any fixed release.","search":"'-121510':15A,18A '-2026':14A,17A '0':51B '1':44B,74B '16':54B '65535':59B,67B 'admin':3A 'administr':37B,111C 'alloc':40B 'allow':114C 'attack':69B,117C 'attacker-chosen':68B 'bit':55B 'bound':106C 'bpv6':2A,20B,36B,110C 'buffer':77B 'bundl':63B,92B 'byte':45B,71B,75B 'caus':9A,120C 'chosen':70B 'code':84B 'counter':56B 'crash':83B 'cve':13A,16A 'declar':48B 'delay':22B 'delay-tolerant-network':21B 'denial':10A 'dos':121C 'eid':42B 'exclud':88B 'execut':85B 'fix':97B 'heap':7A,26B,76B,102C 'heap-overflow':25B 'issu':96B 'length':43B,49B 'make':52B 'network':24B,29B 'network-reach':28B 'node':82B 'one':61B 'out-of-bound':103C 'overflow':27B 'parser':5A,39B,113C 'past':72B 'poc':91B 'public':90B 'reachabl':30B 'record':4A,38B,112C 'reliabl':119C 'remot':6A,100C,116C 'report':79B 'reproduc':80B 'servic':12A 'sourc':41B 'toler':23B 'ud3tn':19A,32B 'unauthent':33B,62B,101C,115C 'underflow':57B 'v0.15.2':99B 'write':8A,64B,107C 'µd3tn':1A,34B,109C","nicknames":[],"mitigations":[],"who_affected":"Any µD3TN node that accepts BPv6 bundles over the mtcp, smtcp or TCPCLv3 convergence layers. A single bundle addressed to the node's own node ID with the administrative-record flag and a zero-length source EID writes up to 65535 bytes past a 1-byte heap buffer before any agent or credential check, which crashes the node; the reporter says code execution cannot be excluded. Nodes whose convergence layers are not reachable by untrusted peers, or that run v0.15.2 or later, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-03T15:26:28Z","by":"analyst","doc":"https://gitlab.com/d3tn/ud3tn/-/raw/master/CHANGELOG.md","run_id":1498},"how_to_check":{"at":"2026-11-03T15:26:28Z","by":"analyst","doc":"https://gitlab.com/d3tn/ud3tn/-/raw/master/CHANGELOG.md","run_id":1498},"who_affected":{"at":"2026-11-03T15:26:28Z","by":"analyst","doc":"https://gitlab.com/d3tn/ud3tn/-/raw/master/CHANGELOG.md","run_id":1498}},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["ud3tn"],"ptokens":["ud3tn"],"labels":["bpv6","delaytolerantnetworking","heapoverflow","high","networkreachable","other","ud3tn","unauthenticated"],"first_public_at":"2026-11-03T15:17:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"cve@gitlab.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-121510","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121510","severity":null,"published_at":"2026-11-03T15:17:38+00:00","modified_at":"2026-11-03T15:17:38+00:00","first_seen_at":"2026-11-03T15:22:01+00:00","fetched_at":"2026-11-03T15:22:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121510:1498","url":null,"severity":null,"published_at":"2026-11-03T15:26:28+00:00","modified_at":"2026-11-03T15:26:28+00:00","first_seen_at":"2026-11-03T15:26:28+00:00","fetched_at":"2026-11-03T15:26:28+00:00","note":"Read issue #289 (reporter's text, PoC bytes included) and vendor CHANGELOG (v0.15.2 fixes #289). Affected lower bound not stated; '<0.15.2' comes from the CNA record via OffSeq (secondary). No exploitation reported; PoC public in the issue, so poc link set. Severity unchanged. Not searched X (obscure project)."}],"documents":[{"id":58438,"url":"https://gitlab.com/d3tn/ud3tn/-/work_items/289","title":"µD3TN issue #289: Heap OOB write in BPv6 admin record parser","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":58435,"url":"https://gitlab.com/d3tn/ud3tn/-/raw/master/CHANGELOG.md","title":"µD3TN CHANGELOG (v0.15.2 security fixes)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":58438,"url":"https://gitlab.com/d3tn/ud3tn/-/work_items/289","title":"µD3TN issue #289: Heap OOB write in BPv6 admin record parser","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"poc","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}