{"id":"CVE-2026-121511","kind":"vulnerability","aliases":["CVE-2026-121511"],"related":[],"title":"µD3TN: integer wrap in fragmenter bounds check lets an external dispatcher read heap memory or crash the daemon","description":"Heap Out-of-Bounds Read in µD3TN BPv6/BPv7 Fragmenter allows Local Attacker to Read Memory and Reliably Cause DoS","summary":"The BPv6 and BPv7 fragmenters check fragment_offset + fragment_length against the payload length with uint64_t values, and the sum can wrap. An AAP 2.0 dispatcher that sends an offset near 2^64 makes the daemon read heap memory before the payload buffer and forward it to the next hop. A larger distance reads unmapped memory and terminates the process. The path exists only when µD3TN runs with --external-dispatch.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ud3tn","fixed":["0.15.2"],"affected":"< 0.15.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["bundle-protocol","dtn","embedded","external-dispatch","package","µd3tn"],"not_affected_if":["dispatcher-secret-set","no-external-dispatch","no-local-access"],"how_to_check":"Only daemons started with --external-dispatch (-d) are reachable. Check the service command line or unit file for that flag, and check the version with the ud3tn binary or your build tag (affected: below 0.15.2 per the CVE record). Also check whether the AAP 2.0 interface is reachable by untrusted local users and whether a dispatcher secret is set. Without a secret the interface accepts dispatcher connections without authentication.","fix":"Upgrade µD3TN to 0.15.2 or later (the CVE record's fixed version). The upstream issue links the fix to MR !273 under milestone v0.16.0, so confirm your release contains the fragment.c bounds fix. Until then, don't use --external-dispatch, or set a dispatcher secret and restrict access to the AAP 2.0 socket/port.","status":"open","published_at":"2026-11-03T15:17:38+00:00","first_seen_at":"2026-11-03T15:22:01+00:00","triaged_at":"2026-11-03T15:22:51+00:00","updated_at":"2026-11-03T15:24:15+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-03T15:22:51Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"µD3TN: heap out-of-bounds read in fragmenter lets local user crash or read memory","impact":"high","summary":"µD3TN's BPv6/BPv7 fragmenter reads past the end of a heap buffer. A local attacker can read process memory and reliably crash the service.","audience":"businesses","category":"package","nicknames":[],"who_cares":["µd3tn","bundle-protocol","dtn","embedded"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Process memory is read and the service can be crashed reliably","analyst_note":"Check the NVD entry and the µD3TN project advisory for affected versions, the fragmenter build condition, and any fixed release.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-local-access"],"who_is_affected":"Only systems running µD3TN's BPv6 or BPv7 bundle fragmenter are at risk, and only a local attacker can trigger it. unknown whether a default build enables the fragmenter. The sources do not name affected versions.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00063,"input_tokens":4109,"output_tokens":439,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the µD3TN project advisory for affected versions, the fragmenter build condition, and any fixed release.","search":"'-121511':21A,24A '-2026':20A,23A '2':68B '2.0':61B '64':69B 'aap':60B 'allow':118C 'attack':120C 'bound':6A,112C 'bpv6':37B 'bpv6/bpv7':116C 'bpv7':39B 'buffer':79B 'bundl':27B 'bundle-protocol':26B 'caus':126C 'check':7A,41B 'crash':16A 'cve':19A,22A 'daemon':18A,72B 'dispatch':11A,33B,62B,107B 'distanc':89B 'dos':127C 'dtn':29B 'embed':30B 'exist':99B 'extern':10A,32B,106B 'external-dispatch':31B,105B 'forward':81B 'fragment':5A,40B,42B,44B,117C 'heap':13A,74B,108C 'hop':86B 'integ':2A 'larger':88B 'length':45B,49B 'let':8A 'local':119C 'make':70B 'memori':14A,75B,92B,123C 'near':67B 'next':85B 'offset':43B,66B 'out-of-bound':109C 'packag':34B 'path':98B 'payload':48B,78B 'process':96B 'protocol':28B 'read':12A,73B,90B,113C,122C 'reliabl':125C 'run':103B 'send':64B 'sum':56B 'termin':94B 'ud3tn':25A 'uint64':51B 'unmap':91B 'valu':53B 'wrap':3A,58B 'µd3tn':1A,35B,102B,115C","nicknames":[],"mitigations":[],"who_affected":"Systems running µD3TN below 0.15.2 started with --external-dispatch, where an AAP 2.0 client acts as the bundle dispatcher. The issue says the internal router and contact scheduling compute the offset from zero and do not trigger it. If you do not use external dispatch, or you set a dispatcher secret and limit who can reach the AAP 2.0 interface, you can skip it. Examples are DTN, space or embedded ground nodes. The report says the unauthenticated case is when no dispatcher secret is set.","tier":"B","verified":{"how_to_check":{"at":"2026-11-03T15:24:15Z","by":"analyst","doc":"https://gitlab.com/d3tn/ud3tn/-/work_items/290","run_id":1497},"who_affected":{"at":"2026-11-03T15:24:15Z","by":"analyst","doc":"https://gitlab.com/d3tn/ud3tn/-/work_items/290","run_id":1497}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["ud3tn"],"ptokens":["ud3tn"],"labels":["bundleprotocol","d3tn","dtn","embedded","externaldispatch","high","package"],"first_public_at":"2026-11-03T15:17:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121511","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121511","severity":null,"published_at":"2026-11-03T15:17:38+00:00","modified_at":"2026-11-03T15:17:38+00:00","first_seen_at":"2026-11-03T15:22:01+00:00","fetched_at":"2026-11-03T15:22:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121511:1497","url":null,"severity":null,"published_at":"2026-11-03T15:24:15+00:00","modified_at":"2026-11-03T15:24:15+00:00","first_seen_at":"2026-11-03T15:24:15+00:00","fetched_at":"2026-11-03T15:24:15+00:00","note":"Read upstream issue #290 (reporter PoC against v0.15.1, closed, fix in MR !273) and NVD CNA record (affected <0.15.2, fixed 0.15.2). Reachable only with --external-dispatch via AAP 2.0; triage's 'local' fits. Fix version not verified: issue says milestone v0.16.0, CNA says 0.15.2. No exploitation reports; PoC is in the issue text. Not searched X."}],"documents":[{"id":58432,"url":"https://gitlab.com/d3tn/ud3tn/-/work_items/290","title":"Heap Out-of-Bounds Read in µD3TN BPv6/BPv7 Fragmenter (#290)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":58433,"url":"https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-121511","title":"NVD record CVE-2026-121511 (CNA: GitLab, affected <0.15.2)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}