---
id: "CVE-2026-121513"
kind: "vulnerability"
aliases: ["CVE-2026-121513"]
title: "\u00b5D3TN SPP parser heap overflow lets remote attackers crash the service"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "ud3tn", "fixed": [], "affected": "0.15.1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["dtn", "mud3tn", "other", "space-protocol"]
not_affected_if: ["unknown"]
published_at: "2026-11-03T15:17:38+00:00"
first_seen_at: "2026-11-03T15:22:01+00:00"
updated_at: "2026-11-03T15:24:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121513", "first_seen_at": "2026-11-03T15:22:01+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T15:24:02+00:00"}]
---

# µD3TN SPP parser heap overflow lets remote attackers crash the service

µD3TN v0.15.1 has an off-by-one heap overflow in its SPP (Space Packet Protocol) parser. An unauthenticated remote attacker can reliably trigger it to cause a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:ud3tn affected 0.15.1 fixed ?

## How to check

- Run ud3tn and check its version: 0.15.1 is the reported affected version.
- Check whether your build or config enables an SPP interface (SPP convergence layer) reachable from untrusted networks; the sources do not say which interfaces are exposed.
- From source: check whether your checkout contains commit 025e819d (spp_timecodes fix); if not, the SPP timecode parser is unpatched.

## Fix

No released fix confirmed. Upstream master commit 025e819d (MR !272, 'spp_timecodes: Restrict parsing to 2 octets', milestone v0.16.0) appears related to the SPP timecode overflow, but it does not name this CVE. Until a release after v0.15.1 ships, build from master at or after that commit or keep SPP inputs off untrusted networks.

## Timeline

- 2026-11-03T15:22:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121513
- 2026-11-03T15:24:02+00:00 analyst — NVD page unreadable via web-cli; no upstream advisory found naming this CVE. Upstream MR !272 (merged to master 2026-10-15, commit 025e819d, milestone v0.16.0, closes issue #288 'spp-timecode-overflow') restricts SPP timecode parsing to 2 octets and looks like the fix, but it does not cite the CVE: inference, not verified. No release containing it seen; latest release v0.15.1.

## Documents

- [describes] NVD CVE-2026-121513 https://nvd.nist.gov/vuln/detail/CVE-2026-121513
- [fix] spp_timecodes: Restrict parsing to 2 octets (!272) https://gitlab.com/d3tn/ud3tn/-/merge_requests/272

## From the sources

Off-by-one Heap Overflow in µD3TN v0.15.1 SPP Parser allows Unauthenticated Remote Attacker to Reliably Cause DoS

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_