Live › vulnerability › CVE-2026-121513
µD3TN v0.15.1 has an off-by-one heap overflow in its SPP (Space Packet Protocol) parser. An unauthenticated remote attacker can reliably trigger it to cause a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:22 UTC. All times on this page are UTC.
Teams running µD3TN v0.15.1 (delay-tolerant networking / space-protocol nodes) with an SPP interface that accepts input from untrusted sources. Nodes that do not use SPP, or whose SPP links come only from trusted peers, can mostly skip it. The CVE text says no authentication is needed; the sources do not name the exact interface or whether older versions are affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| ud3tn | vendor | 0.15.1 | – |
spp_timecodes: Restrict parsing to 2 octets, milestone v0.16.0) appears related to the SPP timecode overflow, but it does not name this CVEv0.15.1 ships, build from master at or after that commit or keep SPP inputs off untrusted networksEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Off-by-one Heap Overflow in µD3TN v0.15.1 SPP Parser allows Unauthenticated Remote Attacker to Reliably Cause DoS
This page as .md · .json · in your agent: get_signal("CVE-2026-121513")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.