---
id: "CVE-2026-121512"
kind: "vulnerability"
aliases: ["CVE-2026-121512"]
title: "\u00b5D3TN: BPv6 bundles with many EID references leak memory, letting an unauthenticated peer crash the node (fixed in 0.15.2)"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "ud3tn", "fixed": ["0.15.2"], "affected": "< 0.15.2", "ecosystem": "vendor"}]
ecosystems: []
tags: ["bpv6", "delay-tolerant-networking", "dos", "memory-leak", "mud3tn", "other", "self-hosted"]
not_affected_if: ["bpv6-disabled"]
published_at: "2026-11-03T15:17:38+00:00"
first_seen_at: "2026-11-03T15:22:01+00:00"
updated_at: "2026-11-03T15:24:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121512", "first_seen_at": "2026-11-03T15:22:01+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T15:24:26+00:00"}]
---

# µD3TN: BPv6 bundles with many EID references leak memory, letting an unauthenticated peer crash the node (fixed in 0.15.2)

bundle_block_free frees a block's EID reference list as a single node and never frees the resolved EID strings, so each BPv6 block with several EID references leaks memory. The reference count is unbounded and each reference can resolve to a copy of a dictionary string up to 32 KiB; the reporter measured about 963 MB leaked by one 92 KB bundle. Any peer reaching the mtcp, smtcp or TCPCLv3 CLA can exhaust memory without authentication. Reporter's PoC bundle is in the issue. No exploitation reported.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:ud3tn affected < 0.15.2 fixed 0.15.2

## How to check

Run your µD3TN build's version (or git tag/commit) and compare to v0.15.2; anything older is in range per the CNA record. You are exposed if the node listens on the mtcp, smtcp or TCPCLv3 convergence layer for peers you do not control. Lower bound of affected versions is not stated by the project; the leaking free path appears in the code before the 0.15.x EID refactor, so treat older releases as affected until the maintainers say otherwise. Workaround: restrict who can reach those CLA ports (firewall/allowlist) until you upgrade.

## Fix

Upgrade µD3TN to v0.15.2 (released 2026-10-26; changelog lists 'Remote Unauthenticated Denial of Service in BPv6 EID Reference Handling (#292)').

## Timeline

- 2026-11-03T15:22:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121512
- 2026-11-03T15:24:26+00:00 analyst — Primary: maintainers' issue #292 (reporter Riccardo Nannini, has PoC bytes) + CHANGELOG v0.15.2 listing the fix. Affected '<0.15.2' comes from CNA data via a secondary page; lower bound unknown. Triage's 'bpv6-disabled' not-affected tag unconfirmed (not stated by project), left untouched. No exploitation seen; X not searched (credits depleted per notes). PoC is inline in the issue (poc relation not linked separately).

## Documents

- [advisory] µD3TN #292: Remote Unauthenticated DoS in BPv6 EID Reference Handling https://gitlab.com/d3tn/ud3tn/-/work_items/292
- [fix] µD3TN CHANGELOG (v0.15.2 security fixes) https://gitlab.com/d3tn/ud3tn/-/raw/master/CHANGELOG.md

## From the sources

Memory Leak with Amplification in µD3TN BPv6 EID Reference Handling allows Unauthenticated Remote Attacker to Cause DoS

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_