{"id":"CVE-2026-121512","kind":"vulnerability","aliases":["CVE-2026-121512"],"related":[],"title":"µD3TN: BPv6 bundles with many EID references leak memory, letting an unauthenticated peer crash the node (fixed in 0.15.2)","description":"Memory Leak with Amplification in µD3TN BPv6 EID Reference Handling allows Unauthenticated Remote Attacker to Cause DoS","summary":"bundle_block_free frees a block's EID reference list as a single node and never frees the resolved EID strings, so each BPv6 block with several EID references leaks memory. The reference count is unbounded and each reference can resolve to a copy of a dictionary string up to 32 KiB; the reporter measured about 963 MB leaked by one 92 KB bundle. Any peer reaching the mtcp, smtcp or TCPCLv3 CLA can exhaust memory without authentication. Reporter's PoC bundle is in the issue. No exploitation reported.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ud3tn","fixed":["0.15.2"],"affected":"< 0.15.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["bpv6","delay-tolerant-networking","dos","memory-leak","mud3tn","other","self-hosted"],"not_affected_if":["bpv6-disabled"],"how_to_check":"Run your µD3TN build's version (or git tag/commit) and compare to v0.15.2; anything older is in range per the CNA record. You are exposed if the node listens on the mtcp, smtcp or TCPCLv3 convergence layer for peers you do not control. Lower bound of affected versions is not stated by the project; the leaking free path appears in the code before the 0.15.x EID refactor, so treat older releases as affected until the maintainers say otherwise. Workaround: restrict who can reach those CLA ports (firewall/allowlist) until you upgrade.","fix":"Upgrade µD3TN to v0.15.2 (released 2026-10-26; changelog lists 'Remote Unauthenticated Denial of Service in BPv6 EID Reference Handling (#292)').","status":"open","published_at":"2026-11-03T15:17:38+00:00","first_seen_at":"2026-11-03T15:22:01+00:00","triaged_at":"2026-11-03T15:22:48+00:00","updated_at":"2026-11-03T15:24:26+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-03T15:22:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"µD3TN: BPv6 EID handling leaks memory, letting remote attackers exhaust resources","impact":"medium","summary":"µD3TN is a delay-tolerant networking (Bundle Protocol) implementation. A memory leak in its BPv6 EID reference handling can be amplified so that an unauthenticated remote attacker causes a denial of service.","audience":"businesses","category":"other","nicknames":[],"who_cares":["mud3tn","bpv6","delay-tolerant-networking"],"confidence":0.4,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote attacker exhausts memory and crashes the service","analyst_note":"Check the NVD entry and the µD3TN project advisory for affected versions, fixed versions, and whether BPv6 must be enabled.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["bpv6-disabled"],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000607,"input_tokens":4093,"output_tokens":395,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the µD3TN project advisory for affected versions, fixed versions, and whether BPv6 must be enabled.","search":"'-121512':22A,25A '-2026':21A,24A '0.15.2':19A '32':91B '92':102B '963':97B 'allow':140C 'amplif':133C 'attack':143C 'authent':118B 'block':42B,46B,65B 'bpv6':2A,27B,64B,136C 'bundl':3A,41B,104B,122B 'caus':145C 'cla':113B 'copi':84B 'count':74B 'crash':14A 'cve':20A,23A 'delay':29B 'delay-tolerant-network':28B 'dictionari':87B 'dos':32B,146C 'eid':6A,48B,60B,68B,137C 'exhaust':115B 'exploit':128B 'fix':17A 'free':43B,44B,57B 'handl':139C 'host':40B 'issu':126B 'kb':103B 'kib':92B 'leak':8A,35B,70B,99B,131C 'let':10A 'list':50B 'mani':5A 'mb':98B 'measur':95B 'memori':9A,34B,71B,116B,130C 'memory-leak':33B 'mtcp':109B 'mud3tn':36B 'network':31B 'never':56B 'node':16A,54B 'one':101B 'peer':13A,106B 'poc':121B 'reach':107B 'refer':7A,49B,69B,73B,79B,138C 'remot':142C 'report':94B,119B,129B 'resolv':59B,81B 'self':39B 'self-host':38B 'sever':67B 'singl':53B 'smtcp':110B 'string':61B,88B 'tcpclv3':112B 'toler':30B 'ud3tn':26A 'unauthent':12A,141C 'unbound':76B 'without':117B 'µd3tn':1A,135C","nicknames":[],"mitigations":[],"who_affected":"Anyone running µD3TN (the delay-tolerant networking / Bundle Protocol node) older than v0.15.2 whose mtcp, smtcp or TCPCLv3 convergence layer is reachable by untrusted peers. A single crafted BPv6 bundle of a few tens of KB can leak hundreds of MB that is never freed, so the process runs out of memory and stops all bundle processing; no authentication is needed. Nodes whose CLA ports are only reachable by trusted peers are far less exposed.","tier":"B","verified":{"fix":{"at":"2026-11-03T15:24:26Z","by":"analyst","doc":"https://gitlab.com/d3tn/ud3tn/-/raw/master/CHANGELOG.md","run_id":1496},"how_to_check":{"at":"2026-11-03T15:24:26Z","by":"analyst","doc":"https://gitlab.com/d3tn/ud3tn/-/raw/master/CHANGELOG.md","run_id":1496},"who_affected":{"at":"2026-11-03T15:24:26Z","by":"analyst","doc":"https://gitlab.com/d3tn/ud3tn/-/raw/master/CHANGELOG.md","run_id":1496}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["ud3tn"],"ptokens":["ud3tn"],"labels":["bpv6","delaytolerantnetworking","dos","high","memoryleak","mud3tn","other","selfhosted"],"first_public_at":"2026-11-03T15:17:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121512","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121512","severity":null,"published_at":"2026-11-03T15:17:38+00:00","modified_at":"2026-11-03T15:17:38+00:00","first_seen_at":"2026-11-03T15:22:01+00:00","fetched_at":"2026-11-03T15:22:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121512:1496","url":null,"severity":null,"published_at":"2026-11-03T15:24:26+00:00","modified_at":"2026-11-03T15:24:26+00:00","first_seen_at":"2026-11-03T15:24:26+00:00","fetched_at":"2026-11-03T15:24:26+00:00","note":"Primary: maintainers' issue #292 (reporter Riccardo Nannini, has PoC bytes) + CHANGELOG v0.15.2 listing the fix. Affected '<0.15.2' comes from CNA data via a secondary page; lower bound unknown. Triage's 'bpv6-disabled' not-affected tag unconfirmed (not stated by project), left untouched. No exploitation seen; X not searched (credits depleted per notes). PoC is inline in the issue (poc relation not linked separately)."}],"documents":[{"id":58434,"url":"https://gitlab.com/d3tn/ud3tn/-/work_items/292","title":"µD3TN #292: Remote Unauthenticated DoS in BPv6 EID Reference Handling","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":58435,"url":"https://gitlab.com/d3tn/ud3tn/-/raw/master/CHANGELOG.md","title":"µD3TN CHANGELOG (v0.15.2 security fixes)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}