Live › vulnerability › CVE-2026-121511
The BPv6 and BPv7 fragmenters check fragment_offset + fragment_length against the payload length with uint64_t values, and the sum can wrap. An AAP 2.0 dispatcher that sends an offset near 2^64 makes the daemon read heap memory before the payload buffer and forward it to the next hop. A larger distance reads unmapped memory and terminates the process. The path exists only when µD3TN runs with --external-dispatch.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:22 UTC. All times on this page are UTC.
Systems running µD3TN below 0.15.2 started with --external-dispatch, where an AAP 2.0 client acts as the bundle dispatcher. The issue says the internal router and contact scheduling compute the offset from zero and do not trigger it. If you do not use external dispatch, or you set a dispatcher secret and limit who can reach the AAP 2.0 interface, you can skip it. Examples are DTN, space or embedded ground nodes. The report says the unauthenticated case is when no dispatcher secret is set.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| ud3tn | vendor | < 0.15.2 | 0.15.2 |
0.15.2 per the CVE record)0.15.2 or later (the CVE record's fixed version)v0.16.0, so confirm your release contains the fragment.c bounds fixEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Heap Out-of-Bounds Read in µD3TN BPv6/BPv7 Fragmenter allows Local Attacker to Read Memory and Reliably Cause DoS
This page as .md · .json · in your agent: get_signal("CVE-2026-121511")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.