Live › vulnerability › CVE-2026-121512
bundle_block_free frees a block's EID reference list as a single node and never frees the resolved EID strings, so each BPv6 block with several EID references leaks memory. The reference count is unbounded and each reference can resolve to a copy of a dictionary string up to 32 KiB; the reporter measured about 963 MB leaked by one 92 KB bundle. Any peer reaching the mtcp, smtcp or TCPCLv3 CLA can exhaust memory without authentication. Reporter's PoC bundle is in the issue. No exploitation reported.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:22 UTC. All times on this page are UTC.
Anyone running µD3TN (the delay-tolerant networking / Bundle Protocol node) older than v0.15.2 whose mtcp, smtcp or TCPCLv3 convergence layer is reachable by untrusted peers. A single crafted BPv6 bundle of a few tens of KB can leak hundreds of MB that is never freed, so the process runs out of memory and stops all bundle processing; no authentication is needed. Nodes whose CLA ports are only reachable by trusted peers are far less exposed.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| ud3tn | vendor | < 0.15.2 | 0.15.2 |
v0.15.2; anything older is in range per the CNA recordUpgrade µD3TN to v0.15.2 (released 2026-10-26; changelog lists Remote Unauthenticated Denial of Service in BPv6 EID Reference Handling (#292)).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Memory Leak with Amplification in µD3TN BPv6 EID Reference Handling allows Unauthenticated Remote Attacker to Cause DoS
This page as .md · .json · in your agent: get_signal("CVE-2026-121512")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.