{"id":"CVE-2026-121513","kind":"vulnerability","aliases":["CVE-2026-121513"],"related":[],"title":"µD3TN SPP parser heap overflow lets remote attackers crash the service","description":"Off-by-one Heap Overflow in µD3TN v0.15.1 SPP Parser allows Unauthenticated Remote Attacker to Reliably Cause DoS","summary":"µD3TN v0.15.1 has an off-by-one heap overflow in its SPP (Space Packet Protocol) parser. An unauthenticated remote attacker can reliably trigger it to cause a denial of service.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ud3tn","fixed":[],"affected":"0.15.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["dtn","mud3tn","other","space-protocol"],"not_affected_if":["unknown"],"how_to_check":"- Run ud3tn and check its version: 0.15.1 is the reported affected version.\n- Check whether your build or config enables an SPP interface (SPP convergence layer) reachable from untrusted networks; the sources do not say which interfaces are exposed.\n- From source: check whether your checkout contains commit 025e819d (spp_timecodes fix); if not, the SPP timecode parser is unpatched.","fix":"No released fix confirmed. Upstream master commit 025e819d (MR !272, 'spp_timecodes: Restrict parsing to 2 octets', milestone v0.16.0) appears related to the SPP timecode overflow, but it does not name this CVE. Until a release after v0.15.1 ships, build from master at or after that commit or keep SPP inputs off untrusted networks.","status":"open","published_at":"2026-11-03T15:17:38+00:00","first_seen_at":"2026-11-03T15:22:01+00:00","triaged_at":"2026-11-03T15:22:48+00:00","updated_at":"2026-11-03T15:24:02+00:00","category":"other","confidence":0.55,"triage":{"at":"2026-11-03T15:22:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"µD3TN SPP parser heap overflow lets remote attackers crash the service","impact":"medium","summary":"µD3TN v0.15.1 has an off-by-one heap overflow in its SPP (Space Packet Protocol) parser. An unauthenticated remote attacker can reliably trigger it to cause a denial of service.","audience":"businesses","category":"other","nicknames":[],"who_cares":["mud3tn","space-protocol","dtn"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"remote crash of the service through heap memory corruption","analyst_note":"Confirm the affected versions, whether a fixed release exists, and which SPP interfaces are exposed, using the NVD entry and the upstream µD3TN project.","how_to_check":"- Check whether the `µD3TN` version in use is `0.15.1`\n- Check whether the SPP parser is reachable from the network (unknown from sources)","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Systems running µD3TN v0.15.1 that accept SPP traffic from untrusted network sources. The sources do not state which deployments or configurations expose the parser, or whether a later version fixes it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000654,"input_tokens":4105,"output_tokens":487,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the affected versions, whether a fixed release exists, and which SPP interfaces are exposed, using the NVD entry and the upstream µD3TN project.","search":"'-121513':14A,17A '-2026':13A,16A 'allow':67C 'attack':8A,45B,70C 'caus':51B,73C 'crash':9A 'cve':12A,15A 'denial':53B 'dos':74C 'dtn':19B 'heap':4A,33B,60C 'let':6A 'mud3tn':20B 'off-by-on':29B,56C 'one':32B,59C 'overflow':5A,34B,61C 'packet':39B 'parser':3A,41B,66C 'protocol':24B,40B 'reliabl':47B,72C 'remot':7A,44B,69C 'servic':11A,55B 'space':23B,38B 'space-protocol':22B 'spp':2A,37B,65C 'trigger':48B 'ud3tn':18A 'unauthent':43B,68C 'v0.15.1':26B,64C 'µd3tn':1A,25B,63C","nicknames":[],"mitigations":[],"who_affected":"Teams running µD3TN v0.15.1 (delay-tolerant networking / space-protocol nodes) with an SPP interface that accepts input from untrusted sources. Nodes that do not use SPP, or whose SPP links come only from trusted peers, can mostly skip it. The CVE text says no authentication is needed; the sources do not name the exact interface or whether older versions are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["ud3tn"],"ptokens":["ud3tn"],"labels":["dtn","high","mud3tn","other","spaceprotocol"],"first_public_at":"2026-11-03T15:17:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121513","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121513","severity":null,"published_at":"2026-11-03T15:17:38+00:00","modified_at":"2026-11-03T15:17:38+00:00","first_seen_at":"2026-11-03T15:22:01+00:00","fetched_at":"2026-11-03T15:22:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121513:1495","url":null,"severity":null,"published_at":"2026-11-03T15:24:02+00:00","modified_at":"2026-11-03T15:24:02+00:00","first_seen_at":"2026-11-03T15:24:02+00:00","fetched_at":"2026-11-03T15:24:02+00:00","note":"NVD page unreadable via web-cli; no upstream advisory found naming this CVE. Upstream MR !272 (merged to master 2026-10-15, commit 025e819d, milestone v0.16.0, closes issue #288 'spp-timecode-overflow') restricts SPP timecode parsing to 2 octets and looks like the fix, but it does not cite the CVE: inference, not verified. No release containing it seen; latest release v0.15.1."}],"documents":[{"id":58430,"url":"https://gitlab.com/d3tn/ud3tn/-/merge_requests/272","title":"spp_timecodes: Restrict parsing to 2 octets (!272)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":58431,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121513","title":"NVD CVE-2026-121513","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}